CVE-2026-123549

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.4

Description An issue exists during self-registration where the system fails to enforce the Valid Creation Attributes list. This allows anonymous attackers to set restricted attributes, such as group membership, by using the legacy self-service REST endpoint or the User Self-Service flow. By manipulating these attributes, an attacker can join administrative groups and obtain full administrative control of the system.

Recommendations Update OpenAM to version 16.1.4 or later.