CVE-2026-46623
Received Received - Intake

OpenAM OAuth2 Account Takeover via Profile Attribute Update

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth2 authentication module updates an existing local account with profile attributes that can include userPassword and inetUserStatus, rewriting the password to the username and reactivating disabled accounts. The missing OAuth.removeRestrictedAccountUpdateAttributes filtering permits these credential and status fields to reach the account update. With account creation enabled, repeated OAuth login causes the default ldapService chain to accept the username as both identifier and password, allowing an unauthenticated attacker to take over the local account without interacting with the identity provider. The rewrite can be denied for usernames shorter than the configured minimum password length. This issue is fixed in version 16.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-46623
EUVD
EUVD-2026-78361

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
forgerock openam 16.1.1
openidentityplatform openam to 16.0.6 (inc)
openidentityplatform openam 16.1.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1391 The product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker.
CWE-620 When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in OpenAM's OAuth2 module allows an unauthenticated attacker to take over user accounts by rewriting passwords to match usernames during login. The system updates local account profiles with OAuth2 attributes, including sensitive fields like userPassword and inetUserStatus, without proper validation. This enables attackers to set the password to the username and reactivate disabled accounts, gaining unauthorized access.

Detection Guidance

Check OpenAM version with command: curl -s http://your-openam-server/openam/version.jsp | grep -i version. If version is <=16.0.6, the system is vulnerable. Review OAuth2 authentication logs for repeated login attempts where password is rewritten to username. Inspect account updates for changes to userPassword or inetUserStatus fields.

Impact Analysis

An attacker could gain full control of your OpenAM account without needing to interact with the identity provider. This includes accessing sensitive data, performing actions on your behalf, and potentially escalating privileges. The attack requires only two OAuth logins if account creation is enabled, and works even on the first re-login for users with matching IdP profiles.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection requirements and HIPAA's access controls. It may result in data breaches, unauthorized modifications, or disclosure of sensitive information, potentially leading to regulatory penalties and loss of compliance certifications.

Mitigation Strategies

Upgrade OpenAM to version 16.1.1 or later immediately. Disable OAuth2 account creation if not required. Review and disable account reactivation features. Implement minimum password length policies to prevent username-as-password attacks. Monitor for unauthorized account modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46623. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart