PKCE Bypass in OpenAM OAuth 2.0 Device Flow

Executive Summary

OpenAM before version 16.1.4 has a flaw in its OAuth 2.0 device authorization flow where PKCE is not enforced. PKCE is a security measure that requires a code verifier during token exchange. Without validation, attackers who steal a device code from logs or shared storage can redeem it for access and ID tokens to impersonate users.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check OpenAM logs for device code exchanges without PKCE validation. Look for token redemption attempts where the code verifier is missing or not validated. Review client configurations to ensure PKCE is enforced in device authorization flows.

Useful 0 Not Useful 0

Impact Analysis

If you use OpenAM versions before 16.1.4, attackers could steal device codes and impersonate users by obtaining access tokens. This could lead to unauthorized access to user accounts, data breaches, or misuse of services. Public clients relying on PKCE are most at risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade OpenAM to version 16.1.4 or later to enforce PKCE validation in device authorization flows.
• Enforce HTTPS for all OAuth 2.0 device authorization flows to prevent interception of device codes.
• Restrict device code grants to trusted clients and shorten device code lifetimes to minimize exposure.
• Use confidential clients where possible, as they are less affected due to their own authentication mechanisms.
• Review and audit issued tokens to detect any unauthorized access or impersonation attempts.

Useful 0 Not Useful 0