Unrated

Authorization bypass in OpenAM Community Edition OAuth2 token-read path

IdentifiersCVE-2026-46498CWE-639

OpenAM Community Edition contains an authorization bypass in the stateful OAuth2 token-read path. According to the provided advisory, if an attacker can place attacker-controlled JSON into the shared Core Token Store under a known identifier, OpenAM will accept that data when reading stateful OAuth2 token material, allowing minting of arbitrary OAuth2 bearer tokens and OIDC ID tokens. The forged token content can include attacker-chosen subject, client, realm, and scope values. The issue affects token validation/trust decisions in the OAuth2/OIDC flow rather than creation of a full OpenAM SSO session.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an attacker to forge valid-looking OAuth2 bearer tokens and OIDC ID tokens for arbitrary identities and clients within affected OAuth2-enabled realms. This can result in unauthorized access to protected resources and identity assertions based on attacker-selected subject, realm, client, and scope values. The provided information indicates the issue does not by itself create an OpenAM SSO session and does not directly grant admin-console access.

Mitigation

If you can’t patch tonight, do this now.

Until patching, disable or tightly restrict any feature, endpoint, or integration path that permits attacker-controlled data to be written into the shared Core Token Store. The advisory specifically notes vulnerable Push Notification registration/callback paths as an example. Also limit exposure of OAuth2 Provider-enabled realms where possible and restrict access to components that can influence Core Token Store contents.

Remediation

Patch, then assume compromise.

Update OpenAM Community Edition to version 16.1.1 or later, which is the fixed release identified in the advisory.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

OpenIdentityPlatformOpenam-Oauth2application

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

No public activity tracked yet. Mallory keeps watching.

0 SOURCESView more in app

No public activity observed for this vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity