CVE-2026-46560
Received Received - Intake

Authentication Bypass in OpenAM RADIUS Module

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `RADIUS` authentication module opens an unconnected datagram socket and trusts the first UDP datagram received on the client source port. The receive path does not verify the source IP and port, match the response identifier to the outstanding request, or verify the RFC 2865 `Response Authenticator`; the RFC 2869 `Message-Authenticator` is neither sent nor required. Any non-Reject/non-Challenge packet is treated as success. On a deployment with a `RADIUS` module instance enabled on a login chain, an unauthenticated network attacker can race the real server on-path or spray forged `Access-Accept` packets off-path and obtain a session for any `RADIUS`-mapped username without knowing the shared secret. Unlike CVE-2024-3596, exploitation requires no MD5 chosen-prefix forgery because no response authenticator is checked. The resulting session carries the impersonated principal's privileges. This issue is fixed in version 16.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-46560

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
OpenIdentityPlatform OpenAM < 16.1.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenAM before 16.1.1 has a RADIUS authentication flaw where it accepts any UDP datagram as a valid response without verifying the source IP, port, response identifier, or RFC 2865 Response Authenticator. This allows attackers to send forged Access-Accept packets and gain unauthorized access to sessions for any RADIUS-mapped username without knowing the shared secret.

Detection Guidance

Detection requires checking if OpenAM is running a vulnerable version (prior to 16.1.1) and if the RADIUS authentication module is enabled. Inspect OpenAM logs for RADIUS authentication attempts and verify the version with commands like 'java -jar openam.jar --version' or checking deployment files.

Impact Analysis

An unauthenticated attacker could impersonate any user account protected by RADIUS authentication, potentially gaining access to sensitive systems or data. This could lead to unauthorized actions, data breaches, or privilege escalation within the affected OpenAM deployment.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using vulnerable OpenAM versions may face compliance violations and regulatory penalties.

Mitigation Strategies

Upgrade OpenAM to version 16.1.1 or later immediately. Disable the RADIUS authentication module if not required. If RADIUS is necessary, restrict network access to the RADIUS server and monitor for suspicious authentication attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46560. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart