Skip to content
CVE PROGRAM SOURCE RECORD7.6 High

CVE-2026-105119

OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose response_type is exactly code, so codes issued through OpenID Connect hybrid flows (code token, code id_token, code token id_token) carry no bound challenge. An attacker who intercepts such a code can redeem it for a public client's tokens with any non-empty code_verifier.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

OpenIdentityPlatform OpenAM

Default version status: unaffected

  • 0 to < 16.1.3affected
  • 16.1.3unaffected
pkg:maven/org.openidentityplatform.openam/openam-oauth2

References