CVE-2026-105117: OpenAM Email Content Injection Vulnerability

CVE-2026-105117 Overview

CVE-2026-105117 is an email content injection vulnerability in OpenAM versions before 16.1.3. The flaw resides in the forgotPassword and register actions exposed at /json/{realm}/users. Unauthenticated attackers can supply arbitrary subject and message fields, causing OpenAM to send attacker-controlled notification emails from the organization's configured From address. The register action can additionally be abused as an open relay to arbitrary recipients. The issue is tracked as improper input validation [CWE-20].

Critical Impact
Attackers can send phishing emails that appear to originate from the trusted identity provider, enabling credential theft and brand abuse against end users and employees.

Affected Products

OpenIdentityPlatform OpenAM versions prior to 16.1.3
Deployments exposing the /json/{realm}/users REST endpoint
OpenAM instances with email notifications enabled for self-service flows

Discovery Timeline

2026-10-03 - CVE-2026-105117 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105117

Vulnerability Analysis

OpenAM exposes REST self-service endpoints at /json/{realm}/users for user registration and password recovery. The forgotPassword and register actions accept subject and message parameters that are passed directly into the outbound email body and headers without validation or sanitization. Because these endpoints require no authentication, any remote attacker can trigger the mailer.

The From address remains the organization's configured sender, so recipients see a legitimate-looking email originating from the identity provider. This enables convincing phishing campaigns against known users via forgotPassword, and arbitrary-recipient abuse via register where the attacker chooses the destination mailbox.

Root Cause

The root cause is improper input validation on user-supplied template fields in the self-service REST handlers. OpenAM treats client-provided subject and message content as trusted notification content rather than untrusted user input. No allow-list, length limit, or server-side template enforcement is applied before the mail transport layer dispatches the message.

Attack Vector

An attacker sends an unauthenticated HTTP POST request to /json/{realm}/users?_action=forgotPassword or /json/{realm}/users?_action=register with a JSON body containing attacker-controlled subject and message fields along with a target username or email. OpenAM renders the attacker's content and delivers it from the configured organizational sender. See the GitHub Security Advisory and the VulnCheck Advisory for OpenAM for request-level details.

Detection Methods for CVE-2026-105117

Indicators of Compromise

Unusual volumes of POST requests to /json/{realm}/users with _action=forgotPassword or _action=register parameters
Outbound SMTP traffic from OpenAM containing non-standard subject or message content that does not match default templates
User reports of password-reset or registration emails that reference unexpected URLs, offers, or credential prompts
Registration-flow emails delivered to recipients that never initiated an OpenAM account

Detection Strategies

Inspect OpenAM access logs for high-frequency, unauthenticated hits to the users REST endpoint from single source IPs or distributed infrastructure
Compare outbound mail body hashes against known-good self-service templates and alert on divergence
Monitor for request bodies containing subject or message keys on the self-service endpoints, which should not be client-controlled

Monitoring Recommendations

Enable verbose request logging on the OpenAM REST tier and forward logs to a centralized analytics platform for retention and correlation
Track mail-server send rates attributed to the OpenAM service account and alert on anomalous spikes
Correlate inbound REST traffic with outbound SMTP volume to identify relay abuse patterns against the register action

How to Mitigate CVE-2026-105117

Immediate Actions Required

Upgrade OpenAM to version 16.1.3 or later, where the self-service handlers no longer accept client-supplied email body content
Restrict network exposure of /json/{realm}/users to trusted origins using a reverse proxy or web application firewall
Rate-limit unauthenticated requests to the forgotPassword and register actions per source IP
Audit outbound mail logs for the past 90 days to identify prior abuse and notify affected recipients

Patch Information

The fix is available in OpenAM 16.1.3. Refer to the GitHub Security Advisory GHSA-mw38-8gr7-c4x2 for the authoritative patch details and upgrade guidance.

Workarounds

Deploy a WAF rule that strips or rejects requests to /json/{realm}/users containing subject or message JSON fields
Disable the register self-service action in realms where it is not required to eliminate the arbitrary-recipient relay path
Enforce DMARC, DKIM, and SPF alignment on the OpenAM sender domain so downstream mail systems can better evaluate suspicious messages