CVE-2026-46623: OpenAM OAuth2 Authentication Bypass Flaw

CVE-2026-46623 Overview

CVE-2026-46623 is an authentication bypass vulnerability in Open Identity Platform's Open Access Management (OpenAM) prior to version 16.1.1. The OAuth2 authentication module updates existing local accounts with profile attributes that include userPassword and inetUserStatus. This behavior rewrites the account password to match the username and reactivates disabled accounts. An unauthenticated attacker can trigger repeated OAuth logins against the default ldapService chain and take over local accounts without any interaction with the upstream identity provider. The flaw is tracked under [CWE-620: Unverified Password Change].

Critical Impact

Remote unauthenticated attackers can hijack local OpenAM accounts by forcing the OAuth2 module to overwrite stored passwords with the target username.

Affected Products

• Open Identity Platform OpenAM versions prior to 16.1.1
• Deployments with OAuth2 authentication module and account creation enabled
• Instances using the default ldapService authentication chain

Discovery Timeline

• 2026-09-15 - CVE-2026-46623 published to the National Vulnerability Database
• 2026-09-17 - Last updated in NVD database
• Fix released - Open Identity Platform published OpenAM 16.1.1 addressing the issue

Technical Details for CVE-2026-46623

Vulnerability Analysis

The OAuth2 authentication module in OpenAM synchronizes profile attributes from the OAuth provider into the local account store when a matching user exists. The module fails to invoke OAuth.removeRestrictedAccountUpdateAttributes before applying the update. As a result, sensitive attributes such as userPassword and inetUserStatus reach the account update path. When the mapped username is copied into the userPassword field, the local credential is silently rewritten to equal the username. Simultaneously, inetUserStatus reactivates any disabled account.

With account creation enabled, the default ldapService chain then accepts the same username string as both identifier and password. Attackers do not need to complete OAuth authentication at the identity provider to trigger the rewrite. The only mitigating condition is that the rewrite is denied when the username is shorter than the configured minimum password length.

Root Cause

The root cause is missing attribute filtering in OAuth.java within openam-authentication/openam-auth-oauth2. Restricted account attributes are not stripped from the profile map before the identity repository update is issued. This exposes credential and status fields to attacker-controlled OAuth profile data.

Attack Vector

An unauthenticated remote attacker initiates repeated OAuth2 logins against a vulnerable OpenAM deployment. The OAuth flow returns profile attributes that map onto an existing local account, and OpenAM writes the username value into userPassword. The attacker then authenticates directly to the ldapService chain using the target username as both the login and password.

 import com.sun.identity.authentication.util.ISAuthConstants;
 import com.sun.identity.idm.AMIdentity;
 import com.sun.identity.idm.IdRepoException;
+import com.sun.identity.idm.PasswordPolicyException;
 import com.sun.identity.shared.debug.Debug;
 import com.sun.identity.shared.encode.Base64;
 import com.sun.identity.shared.encode.CookieUtils;

Source: GitHub Commit 7993f6d. The patch introduces PasswordPolicyException handling and filters restricted attributes before applying account updates.

Detection Methods for CVE-2026-46623

Indicators of Compromise

• Repeated OAuth2 authentication requests targeting the same local username from a single source address
• Successful ldapService chain logins where the submitted password equals the username
• Unexpected reactivation of accounts previously marked with inetUserStatus=Inactive
• Audit log entries showing userPassword modification originating from the OAuth2 module

Detection Strategies

• Correlate OpenAM authentication audit logs for OAuth2 login events immediately followed by ldapService authentications for the same principal
• Alert on identity repository writes to userPassword where the calling module is OAuth
• Baseline login patterns for the ldapService chain and flag credentials matching the username value

Monitoring Recommendations

• Forward OpenAM access.audit.json and authentication.audit.json streams to a centralized log platform for correlation
• Monitor LDAP or DS server logs for modify operations targeting userPassword attributes on service accounts
• Track account status transitions and alert on programmatic reactivation of disabled accounts

How to Mitigate CVE-2026-46623

Immediate Actions Required

• Upgrade all OpenAM instances to version 16.1.1 or later without delay
• Audit local accounts for unauthorized password resets and disabled-to-active status transitions since OAuth2 was enabled
• Rotate credentials for any local accounts that were candidates for OAuth2 profile mapping
• Review OAuth2 module configuration and disable account creation where it is not required

Patch Information

The vulnerability is fixed in OpenAM 16.1.1. The upstream fix is available in GitHub Release 16.1.1 and documented in GitHub Security Advisory GHSA-gf57-4mp6-m85x. The patch adds PasswordPolicyException handling and calls removeRestrictedAccountUpdateAttributes before applying OAuth profile data to local accounts.

Workarounds

• Disable the OAuth2 authentication module until the upgrade to 16.1.1 is complete
• Disable the create-account-if-not-exists option in the OAuth2 module configuration
• Enforce a minimum password length longer than the longest expected username, since the rewrite is denied for usernames shorter than the configured minimum
• Remove the ldapService fallback chain from realms that expose OAuth2 to untrusted clients

# Verify installed OpenAM version and upgrade to the fixed release
curl -sk https://openam.example.com/openam/json/serverinfo/version

# Deploy the patched war from the 16.1.1 release
wget https://github.com/OpenIdentityPlatform/OpenAM/releases/download/16.1.1/OpenAM-16.1.1.war