Skip to main content
Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack TechniqueRead More
Vulnerability Database/CVE-2026-45052

CVE-2026-45052: OpenAM Authentication Bypass Vulnerability

CVE-2026-45052 is an authentication bypass vulnerability in Open Access Management (OpenAM) allowing unauthenticated attackers to manipulate Liberty Discovery data. This article covers technical details, affected versions, and mitigation.

Published:

CVE-2026-45052 Overview

Open Access Management (OpenAM) contains a broken authorization flaw in its Liberty Web Services SOAP receiver. Prior to version 16.1.1, the SOAPReceiver and DiscoveryService handlers permit unauthenticated remote requests to write persistent entries into a user's Liberty Discovery store and into the shared root-realm Discovery branch. Server-side handlers bypass requester LDAP and identity ACLs, and the global path uses an internal administrative token. Downstream deployments that consume Liberty discovery data can then act on attacker-manipulated service-routing or security-mechanism records. The Open Identity Platform project fixed the issue in OpenAM 16.1.1.

Critical Impact

Unauthenticated attackers can inject persistent Liberty Discovery entries that influence service routing and security-mechanism selection across relying deployments.

Affected Products

  • Open Identity Platform OpenAM versions prior to 16.1.1
  • Deployments exposing the /Liberty/* SOAP endpoint (WSSOAPReceiver servlet)
  • Deployments exposing the /WSPRedirectHandler/* endpoint consuming Liberty discovery data

Discovery Timeline

  • 2026-09-15 - CVE-2026-45052 published to the National Vulnerability Database (NVD)
  • 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-45052

Vulnerability Analysis

The flaw is an improper authorization weakness [CWE-285] in the Liberty ID-WSF SOAP processing stack. The SOAPReceiver servlet, mounted at /Liberty/*, dispatches incoming SOAP envelopes to service handlers including DiscoveryService. These handlers write persistent Liberty Discovery entries without verifying that the SOAP requester is authenticated or authorized against the target resource. Writes to a user-scoped Discovery store bypass requester LDAP and identity ACL checks. Writes into the shared root-realm Discovery branch execute under an internal administrative token, so no external credential is validated. An attacker with network access to the endpoint can plant persistent records that later steer identity federation traffic.

Root Cause

The root cause is that server-side handlers assume the caller has already been authorized upstream. The Liberty SOAP endpoint does not enforce authentication for sensitive handlers such as Discovery, IDPP, AuthnSvc, and Interaction. The global write path uses an administrative token rather than the requester context, so identity ACLs never apply to root-realm entries.

Attack Vector

Exploitation requires only network reachability to the OpenAM /Liberty/* endpoint. The attacker crafts a SOAP envelope invoking the DiscoveryService write operation with attacker-chosen ServiceInstance, ResourceOffering, or SecurityMechID values. Once persisted, other services that resolve Liberty discovery entries retrieve the poisoned records and may route requests to attacker-controlled endpoints or downgrade security mechanisms.

The upstream fix disables the vulnerable endpoints by default via a new advanced server property. The patched documentation reflects the new gating:

text
`/Liberty/*`::
Used by a servlet named `WSSOAPReceiver`. Associated with the `SOAPReceiver` class. Defines an endpoint that handles SOAP requests.

This endpoint is disabled by default and returns HTTP 404 for every request unless the advanced server property `com.sun.identity.liberty.enabled` is set to `true`.

`/WSPRedirectHandler/*`::
Used by a servlet named `WSPRedirectHandler`. Associated with the `WSPRedirectHandlerServlet` class. Used by the SP for user redirects.

This endpoint is also gated by the advanced server property `com.sun.identity.liberty.enabled` (default `false`).

Source: OpenAM patch commit 07e402c

Detect Identity Attacks the Moment Authentication Fails

Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.

Stop Identity Attacks

Detection Methods for CVE-2026-45052

Indicators of Compromise

  • Unexpected SOAP POST requests to /Liberty/* or /WSPRedirectHandler/* from untrusted networks
  • New or modified Liberty Discovery ResourceOffering entries pointing to external or unfamiliar service URIs
  • Discovery entries in the shared root-realm branch created outside of provisioning workflows
  • Federation traffic routed to endpoints that do not match documented service inventory

Detection Strategies

  • Enable HTTP access logging on the OpenAM container and alert on unauthenticated POSTs to /Liberty/SOAPReceiver and /Liberty/DiscoveryService
  • Audit the Liberty Discovery data store for ResourceOffering and SecurityMechID values that reference off-network hosts
  • Compare Discovery entries against a known-good baseline exported before upgrading to 16.1.1

Monitoring Recommendations

  • Forward OpenAM access and audit logs to a centralized SIEM and retain them for federation-incident forensics
  • Monitor for SOAP envelopes containing DiscoveryService write actions originating from outside identity administration subnets
  • Alert on changes to root-realm Discovery entries, which should be rare after initial deployment

How to Mitigate CVE-2026-45052

Immediate Actions Required

  • Upgrade all OpenAM instances to version 16.1.1 or later
  • If upgrade is not immediate, block external access to /Liberty/* and /WSPRedirectHandler/* at the reverse proxy or WAF
  • Review existing Liberty Discovery entries for unauthorized ResourceOffering or SecurityMechID records and remove them
  • Rotate any credentials or tokens associated with services referenced by suspicious discovery entries

Patch Information

The fix is available in OpenAM Release 16.1.1. Details are published in GitHub Security Advisory GHSA-p462-xxwx-pqf4. The patch disables the Liberty ID-WSF SOAP endpoints by default and introduces advanced server properties to control handler behavior, as shown in commit 07e402c.

Workarounds

  • Leave the advanced server property com.sun.identity.liberty.enabled set to its default value of false if Liberty ID-WSF is not required
  • Restrict the sensitiveHandlers list via com.sun.identity.liberty.sensitiveHandlers and keep com.sun.identity.liberty.allowAnonymousWSC disabled
  • Enforce network-level ACLs so only trusted federation partners can reach the Liberty SOAP endpoints
bash
# Advanced server properties to disable vulnerable Liberty endpoints
com.sun.identity.liberty.enabled=false
com.sun.identity.liberty.allowAnonymousWSC=false
com.sun.identity.liberty.soap.sensitiveHandlers=IDPP,Discovery,AuthnSvc,Interaction

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne