CVE-2026-47426: OpenAM Client Authentication Bypass Vulnerability

CVE-2026-47426 Overview

CVE-2026-47426 is an authentication vulnerability in Open Identity Platform's Open Access Management (OpenAM) affecting versions prior to 16.1.1. The flaw resides in the private_key_jwt client authentication path, where ClientJwksResolverCache fails to reliably bind a cached jwks_uri resolver and verified assertion to the expected clientID in ClientCredentialsReader. An attacker who controls any registered client with published keys can authenticate as another client whose keys are exposed through jwks_uri. The attacker can then mint tokens in that victim client's name across realms within the same OpenAM process. The issue is categorized under [CWE-287] Improper Authentication.

Critical Impact
A low-privileged authenticated attacker with a registered OAuth client can impersonate any other OAuth client that publishes keys via jwks_uri, minting tokens in the victim client's name across all realms in the same OpenAM process.

Affected Products

Open Identity Platform OpenAM versions prior to 16.1.1
OpenAM deployments with private_key_jwt client authentication enabled
OpenAM instances where open dynamic client registration is enabled

Discovery Timeline

2026-09-15 - CVE-2026-47426 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-47426

Vulnerability Analysis

The vulnerability exists in OpenAM's OAuth 2.0 client authentication flow when clients use private_key_jwt as their authentication method. During this flow, a client proves its identity by presenting a signed JWT assertion. OpenAM resolves the signing keys by fetching the client's published JSON Web Key Set (JWKS) from the URL registered in jwks_uri. To improve performance, OpenAM caches these resolvers through ClientJwksResolverCache. The cache lookup does not enforce a strong binding between the resolver, the verified assertion, and the expected client identifier processed by ClientCredentialsReader. This weak binding allows cross-client confusion during assertion verification, enabling one authenticated client to be treated as another.

Root Cause

The root cause is a missing invariant in ClientCredentialsReader: the code that consumes a verified private_key_jwt assertion does not verify that the JWKS resolver and validated signature correspond to the client_id claimed in the token request. Because the cache keying and validation logic do not consistently tie together jwks_uri, the resolver instance, and the target clientID, an assertion signed by an attacker's legitimately published key can satisfy authentication checks for a different client. The scope extends across realms handled by the same OpenAM process.

Attack Vector

The attack requires network access to the OpenAM authorization endpoints and a legitimately registered OAuth client controlled by the attacker. Where open dynamic client registration is enabled, the attacker can self-register such a client without administrator involvement. The attacker publishes a JWKS at a URL they control and crafts a private_key_jwt assertion. Through the cache confusion, the assertion is accepted as authentication for a targeted victim client, allowing the attacker to obtain OAuth tokens issued under the victim's identity.

java

// Security patch attribution update in ClientCredentialsReader.java
 * Copyright 2015-2016 ForgeRock AS.
 * Portions Copyrighted 2015 Nomura Research Institute, Ltd.
- * Portions copyright 2025 3A Systems LLC.
+ * Portions copyright 2025-2026 3A Systems LLC.
 */
package org.forgerock.openam.oauth2;

Source: GitHub Commit 91acaf4. The fix modifies ClientCredentialsReader.java and OpenAMClientRegistration.java to enforce correct binding between cached resolvers and the requesting client identifier.

Detection Methods for CVE-2026-47426

Indicators of Compromise

OAuth token requests to /oauth2/access_token using client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer where the assertion issuer or key origin does not match the requesting client_id.
Newly registered OAuth clients created via the dynamic client registration endpoint that reference external jwks_uri values on attacker-controlled hosts.
Access tokens issued to a client from an IP address, user agent, or geolocation inconsistent with the client's normal issuance patterns.

Detection Strategies

Correlate client_id values in OpenAM audit logs against the iss and sub claims in submitted private_key_jwt assertions to identify mismatches.
Baseline the set of jwks_uri hosts referenced by registered clients and alert on new or externally hosted values, especially those introduced through dynamic registration.
Monitor for token issuance to sensitive clients from unexpected sources and investigate the associated client assertion metadata.

Monitoring Recommendations

Enable and forward OpenAM OAuth 2.0 audit logs, including access.audit.json and authentication events, to a centralized logging platform for retention and correlation.
Alert on any successful private_key_jwt authentication that immediately follows a dynamic client registration event within a short time window.
Track configuration changes to OAuth clients and to the dynamic client registration policy, including additions or modifications of jwks_uri values.

How to Mitigate CVE-2026-47426

Immediate Actions Required

Upgrade all OpenAM instances to version 16.1.1, which contains the fix committed in GitHub Commit 91acaf4.
Review the GHSA-f2cx-463q-7m2c security advisory for the authoritative vendor guidance.
Audit all OAuth clients configured with private_key_jwt authentication and rotate any tokens or credentials that may have been issued under impersonated identities.

Patch Information

The vulnerability is fixed in OpenAM 16.1.1, available at GitHub Release 16.1.1. The patch updates ClientCredentialsReader.java and OpenAMClientRegistration.java in the openam-oauth2 module to bind the cached JWKS resolver and verified assertion to the expected clientID, preventing cross-client authentication confusion.

Workarounds

Disable open dynamic client registration until the upgrade to 16.1.1 is complete to reduce the attacker's ability to introduce a controlled client with published keys.
Restrict private_key_jwt client authentication to clients whose jwks_uri hosts are on an approved allow-list under administrative control.
Separate high-value OAuth workloads into dedicated OpenAM processes so that cross-realm impersonation within a single process cannot reach sensitive clients.

bash

# Verify the running OpenAM version and confirm the upgrade
curl -s https://openam.example.com/openam/json/serverinfo/version | jq .

# Expected output after remediation should show version 16.1.1 or later