CVE-2026-123549 OpenAM before 16.1.4 Privilege Escalation via Self-Registration Attribute Bypass
CriticalCVSS 9.3
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, allowing anonymous attackers to set restricted attributes including group membership. Attackers can register through the legacy self-service REST endpoint or User Self-Service flow to join administrative groups and gain full administrative control of OpenAM.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.openidentityplatform.openam/openam-core-rest | < 16.1.4 | 16.1.4 |
References
- GitHub Security Advisory (GHSA-jv8f-m88g-h6mm) vendor-advisory
- VulnCheck Advisory: OpenAM before 16.1.4 Privilege Escalation via Self-Registration Attribute Bypass third-party-advisory