PT-2026-139826

CVE-2026-123545

Published

2026-11-08

Updated

2026-11-08

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenAM versions 14.5.1 through 16.1.3

Description A cross-site request forgery issue exists in the OAuth 2.0 device authorization flow. This occurs when consent is skipped for implied-consent clients, allowing an attacker to approve device codes. By luring a logged-in user to a specially crafted page, an attacker can obtain access and ID tokens to make API calls on behalf of that user.

Recommendations Update OpenAM to version 16.1.4 or later.

Exploitability

Exploit

Fix

Impacts

Researchers