CVE-2026-45052
Received Received - Intake

Unauthenticated Write Access in OpenAM Liberty Web Services

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the Liberty Web Services SOAP receiver permits unauthenticated remote requests to write persistent entries through SOAPReceiver and DiscoveryService into a user's Liberty Discovery store and the shared root-realm Discovery branch. The server-side handlers bypass requester LDAP and identity ACLs, and the global path uses an internal administrative token. Deployments that consume Liberty discovery data can subsequently use manipulated service-routing or security-mechanism records. This issue is fixed in version 16.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-45052
EUVD
EUVD-2026-78352

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
forgerock openam to 16.1.1 (exc)
openidentityplatform openam to 16.0.6 (inc)
openidentityplatform openam 16.1.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-45052 is an Improper Authorization vulnerability in OpenAM's Liberty Web Services SOAP receiver. It allows unauthenticated remote attackers to write persistent entries into the Liberty Discovery store on any user's LDAP entry and a shared root-realm Discovery branch. The issue occurs because the endpoint accepts anonymous writes performed server-side by Discovery handlers, bypassing requester LDAP and identity access control lists.

Detection Guidance

Check if OpenAM versions up to 16.0.6 are running. Inspect logs for unauthorized SOAP requests to /Liberty/* or /WSPRedirectHandler/*. Verify if com.sun.identity.liberty.enabled is set to true in configurations.

Impact Analysis

An attacker could manipulate service-routing or security-mechanism records in the Discovery store. If downstream systems consume Liberty discovery data, this could influence how services are routed or which security mechanisms are selected. The vulnerability does not require active Liberty consumers for exploitation.

Mitigation Strategies

Upgrade OpenAM to version 16.1.1 or later. Disable the Liberty SOAP endpoints by setting com.sun.identity.liberty.enabled to false. Restrict access to DiscoveryService and SOAPReceiver handlers. Monitor for anomalous SOAP requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45052. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart