CVE-2026-105117

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-03

Last updated on: 2026-10-06

Assigner: VulnCheck

Description

OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control notification email wording via the forgotPassword and register actions on /json/{realm}/users. Attackers can supply subject and message fields to send phishing mail from the organisation's configured From address, or abuse register as a relay to arbitrary recipients.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-03

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-03

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105117

EUVD

EUVD-2026-92021

Affected Vendors & Products

Vendor	Product	Version / Range
OpenIdentityPlatform	OpenAM	0
OpenIdentityPlatform	OpenAM	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

OpenAM before version 16.1.3 has an email content injection flaw. Unauthenticated attackers can manipulate notification emails sent via the forgotPassword and register actions on the /json/{realm}/users endpoint. They can control email subject and message fields, enabling phishing emails to be sent from the organization's configured address or using the register function as a mail relay.

Detection Guidance

Check OpenAM version with curl -s http://your-openam-server/openam/version | grep -i version. If version is before 16.1.3, the system is vulnerable. Inspect network traffic for unusual SMTP connections from OpenAM server to external mail servers, especially to unknown recipients.

Impact Analysis

Attackers can send phishing emails that appear to come from your organization, tricking recipients into clicking malicious links or revealing sensitive information. The register action can be abused to send emails to arbitrary recipients, potentially spreading malware or conducting social engineering attacks.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face fines or penalties for failing to protect user data from phishing attacks facilitated by this flaw.

Mitigation Strategies

Upgrade OpenAM to version 16.1.3 or later immediately. Disable legacy self-service actions (forgotPassword and register) if not needed. Configure reverse proxy to strip caller-supplied email content. Rate-limit the affected endpoints to reduce abuse.

Hi! I’m here to help you understand CVE-2026-105117. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70