CVE-2026-105119: OpenAM OAuth2 PKCE Auth Bypass Vulnerability

CVE-2026-105119 Overview

CVE-2026-105119 affects OpenAM versions before 16.1.3. The flaw resides in the OAuth2 Provider's Proof Key for Code Exchange (PKCE) enforcement logic. OpenAM applies PKCE validation only to authorization requests whose response_type equals code. Authorization codes issued through OpenID Connect hybrid flows (code token, code id_token, code token id_token) are issued without a bound challenge. An attacker who intercepts such a code can redeem it for a public client's tokens using any non-empty code_verifier. The weakness is classified under CWE-285: Improper Authorization.

Critical Impact

Intercepted authorization codes from hybrid flows can be exchanged for valid OAuth2 tokens, enabling account takeover of public OIDC clients without knowledge of the original PKCE verifier.

Affected Products

• OpenIdentityPlatform OpenAM versions prior to 16.1.3
• Deployments acting as OAuth2 Provider with public clients using OIDC hybrid flows
• Any relying party configured with response_type values of code token, code id_token, or code token id_token

Discovery Timeline

• 2026-10-03 - CVE-2026-105119 published to NVD
• 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105119

Vulnerability Analysis

OpenAM implements PKCE to bind an authorization code to a client-generated secret, defeating code interception attacks against public clients. The enforcement check keys off the exact string code in the response_type parameter. OpenID Connect hybrid response types combine code with token or id_token, producing multi-valued response_type strings. OpenAM's conditional does not match these combinations, so the server skips challenge binding when issuing the authorization code. The code is then redeemable at the token endpoint if the request includes any non-empty code_verifier, since OpenAM has no stored challenge against which to compare.

An attacker who obtains the code through browser history, referer leakage, open redirectors, logs, or a malicious application on the client device can impersonate the user. The resulting tokens carry the full scope and audience granted during authorization.

Root Cause

The root cause is an incomplete authorization check [CWE-285]. The PKCE enforcement predicate performs a string equality comparison against code rather than testing whether code is one of the requested response types. Hybrid flows that legitimately include code bypass the enforcement path entirely.

Attack Vector

Exploitation requires network access to intercept or observe an authorization code in transit or at rest on the client. The attacker initiates a token request to the OpenAM /oauth2/access_token endpoint using the intercepted code, the public client identifier, and an arbitrary non-empty code_verifier. OpenAM returns access and refresh tokens without verifying the verifier against any stored challenge. User interaction is required to generate the original authorization flow, which is reflected in the attack complexity rating.

No verified proof-of-concept code is published. Technical details are documented in the GitHub Security Advisory GHSA-5p2f-7vcr-6vfh and the VulnCheck Advisory for OpenAM Bypass.

Detection Methods for CVE-2026-105119

Indicators of Compromise

• Token endpoint requests containing code_verifier values that do not correspond to any challenge recorded during the authorization step.
• Successful token issuance to public clients configured with hybrid response_type values such as code id_token or code token id_token.
• Authorization code redemptions from client IP addresses or user agents that differ from the originating authorization request.

Detection Strategies

• Audit OpenAM OAuth2 access logs for response_type values containing more than one token type combined with public client identifiers.
• Correlate authorization code issuance events with their redemption events and alert on mismatched source attributes.
• Review client registration data to identify public clients permitted to use hybrid flows and track their token activity.

Monitoring Recommendations

• Enable verbose OAuth2 audit logging on OpenAM and forward events to a centralized SIEM for correlation.
• Monitor for anomalous token refresh activity following hybrid-flow authorizations, especially from new geolocations or devices.
• Track OpenAM version strings across deployments to confirm instances have been upgraded to 16.1.3 or later.

How to Mitigate CVE-2026-105119

Immediate Actions Required

• Upgrade OpenAM to version 16.1.3 or later across all OAuth2 Provider deployments.
• Inventory registered OAuth2 clients and identify any public clients that permit hybrid response_type values.
• Rotate client secrets and revoke outstanding refresh tokens for impacted public clients after patching.

Patch Information

The fix is included in OpenAM 16.1.3. The patched version extends PKCE enforcement to all authorization requests that include code as a component of response_type, covering hybrid flows. Review the GitHub Security Advisory GHSA-5p2f-7vcr-6vfh for the complete patch notes.

Workarounds

• Disable hybrid response_type values for public clients at the OpenAM OAuth2 Provider configuration until the patch is applied.
• Restrict public clients to the pure code flow where PKCE enforcement remains active.
• Shorten authorization code lifetimes to reduce the window during which an intercepted code can be redeemed.

# Configuration example - restrict allowed response_types for a public client
# Edit the OAuth2 client profile in OpenAM admin console or via ssoadm:
ssoadm update-agent \
  --realm / \
  --agentname my-public-client \
  --attributevalues "com.forgerock.openam.oauth2provider.responseTypes=code"