CVE-2026-47426
Received Received - Intake

OpenAM JWT Client Authentication Privilege Escalation

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the private_key_jwt client authentication path uses ClientJwksResolverCache without reliably binding a cached jwks_uri resolver and verified assertion to the expected clientID in ClientCredentialsReader. An attacker controlling any registered client with published keys, including one obtained through open dynamic registration when enabled, can authenticate as another client whose keys are exposed through jwks_uri and mint tokens in that client's name across realms in the same OpenAM process. This issue is fixed in version 16.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-47426
EUVD
EUVD-2026-78368

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
forgerock openam 16.1.1
openidentityplatform openam to 16.1.1 (exc)
openidentityplatform openam to 16.0.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-47426 is an improper authentication vulnerability in OpenAM, an access management solution. It affects the private_key_jwt client authentication mechanism where an attacker controlling any registered client can impersonate another client whose keys are exposed through jwks_uri. This allows minting tokens in the victim client's name across realms in the same OpenAM process.

Detection Guidance

To detect this vulnerability, check if your OpenAM instance is running a version prior to 16.1.1. Use commands like 'curl -s http://your-openam-server/openam/version' or check the version in the OpenAM admin console. If the version is below 16.1.1, the system is vulnerable.

Impact Analysis

This vulnerability allows an attacker to gain unauthorized access to resources or perform actions on behalf of another client. If you use OpenAM for authentication, an attacker could impersonate a legitimate client, potentially accessing sensitive data or performing privileged operations without proper authorization.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Non-compliance may result in legal penalties, reputational damage, and loss of trust in systems handling protected information.

Mitigation Strategies

Upgrade OpenAM to version 16.1.1 or later immediately. This version includes fixes for improper JWT client assertion validation and JWKS resolver cache misuse. If upgrading is not immediately possible, disable the private_key_jwt client authentication mechanism as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47426. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart