CVE-2026-123545
Received Received - Intake

Cross-Site Request Forgery in OpenAM OAuth 2.0 Device Flow

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device authorization flow that allows attackers to approve device codes when consent is skipped for implied-consent clients. Attackers can start a device authorization and lure a logged-in user to a crafted page, obtaining access and ID tokens to call APIs as that user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123545
EUVD
EUVD-2026-119430

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
forgerock openam to 16.1.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site request forgery (CSRF) flaw in OpenAM's OAuth 2.0 device authorization flow. It affects versions 14.5.1 through 16.1.3. When consent is skipped for certain clients, attackers can trick logged-in users into approving device codes without their knowledge by having them visit a malicious link. This allows attackers to obtain access and ID tokens, granting unauthorized access to the user's profile claims and APIs.

Detection Guidance

Detecting this vulnerability requires checking OpenAM versions and OAuth 2.0 device flow configurations. Verify if your OpenAM version is between 14.5.1 and 16.1.3. Inspect OAuth 2.0 clients for 'Allow clients to skip consent' settings and implied consent configurations. Review logs for unauthorized token approvals or suspicious device flow activities.

Impact Analysis

If you use OpenAM with OAuth 2.0 device flow and implied-consent clients, an attacker could gain access to your account and perform actions on your behalf. This includes accessing your data and calling APIs until tokens expire or are revoked. The impact depends on the permissions of the compromised account.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, unauthorized disclosures, and non-compliance with access control and consent management regulations.

Mitigation Strategies
  • Upgrade OpenAM to version 16.1.4 or later to apply the official fix.
  • Disable 'Allow clients to skip consent' in OAuth 2.0 client configurations.
  • Restrict implied consent to confidential clients only.
  • Block or restrict access to device flow endpoints if not required.
  • Review and revoke any unauthorized access or ID tokens issued before patching.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123545. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...