CVE-2026-46560

Name of the Vulnerable Software and Affected Versions Open Access Management (OpenAM) versions prior to 16.1.1

Description The RADIUS authentication module contains an improper verification of cryptographic signature issue. The module opens an unconnected datagram socket and trusts the first UDP datagram received on the client source port without verifying the source IP and port, matching the response identifier to the outstanding request, or verifying the RFC 2865 Response Authenticator. Additionally, the RFC 2869 Message-Authenticator is neither sent nor required. Consequently, any packet that is not a Reject or Challenge is treated as a success. An unauthenticated network attacker can race the real server on-path or spray forged Access-Accept packets off-path to obtain a session for any RADIUS-mapped username without knowing the shared secret, granting them the privileges of the impersonated principal.

Recommendations Update to version 16.1.1.