CVE-2026-48717: OpenAM PKCE Authorization Bypass Vulnerability

CVE-2026-48717 Overview

CVE-2026-48717 is an authorization bypass vulnerability in Open Identity Platform's Open Access Management (OpenAM) affecting versions prior to 16.1.1. The flaw resides in AuthorizationCodeGrantTypeHandler, which enforces the OAuth 2.0 Proof Key for Code Exchange (PKCE) code_verifier only when the realm-wide codeVerifierEnforced setting is enabled. Because this setting is disabled by default, an attacker who intercepts a PKCE-protected authorization code can omit the code_verifier and successfully redeem the code. The issue maps to [CWE-285: Improper Authorization] and is resolved in OpenAM 16.1.1.

Critical Impact

Attackers who intercept PKCE-protected authorization codes can bypass the code exchange verification, redeem tokens without possession of the original code_verifier, and impersonate legitimate OAuth clients — particularly public clients such as single-page and mobile applications.

Affected Products

• Open Identity Platform OpenAM versions prior to 16.1.1
• OAuth 2.0 Provider service using PKCE-protected authorization code grant
• Public OAuth clients (single-page apps, mobile apps) relying on PKCE for authorization code protection

Discovery Timeline

• 2026-09-15 - CVE-2026-48717 published to NVD
• 2026-09-15 - Last updated in NVD database
• Version 16.1.1 - Open Identity Platform releases patched OpenAM version

Technical Details for CVE-2026-48717

Vulnerability Analysis

PKCE (RFC 7636) protects the OAuth 2.0 authorization code grant against interception attacks. A client generates a code_verifier, derives a code_challenge, and submits the challenge during the authorization request. When redeeming the code at the token endpoint, the client must present the matching code_verifier, which the server validates against the stored challenge.

OpenAM's AuthorizationCodeGrantTypeHandler deviates from the RFC. It requires a code_verifier only when the realm-wide codeVerifierEnforced toggle is active. Because that toggle is off by default, the server accepts token requests that omit code_verifier entirely, even when the authorization code carries a bound code_challenge. An explicitly incorrect verifier is still rejected, but silently omitting the parameter bypasses the check.

The practical result: an attacker who obtains a leaked or intercepted authorization code can exchange it for tokens without possessing the corresponding code_verifier. This defeats the anti-interception guarantee PKCE was designed to provide.

Root Cause

The root cause is a conditional enforcement check that ties per-code PKCE validation to a global configuration flag. Correct behavior requires binding validation to the presence of code_challenge on the individual authorization code, not to a realm-wide setting.

Attack Vector

Attack execution requires the adversary to obtain a valid authorization code — typically through logs, referer leakage, browser history exposure, or a compromised redirect URI. Public clients are directly exploitable. Confidential clients additionally require valid client authentication material or another redemption context.

// Patch excerpt from openam-doc-source/chap-oauth2.adoc
// Source: https://github.com/OpenIdentityPlatform/OpenAM/commit/97a34d9fee17395e8e052bfc45eb5855f436153e

- * `code_challenge`. Use this parameter when Proof Key for Code Exchange (PKCE)
-   support is enabled in the OAuth2 Provider service. To configure it, navigate
-   to Realms > Realm Name > Services > OAuth2 Provider > Advanced and enable
-   the Code Verifier Parameter Required property.

+ * `code_challenge`. Use this parameter to protect the authorization code grant
+   with Proof Key for Code Exchange (PKCE). When you send a `code_challenge`,
+   OpenAM binds it to the issued authorization code and always requires the
+   matching `code_verifier` at the token endpoint, regardless of provider
+   settings. To force *all* clients to use PKCE, navigate to Realms > Realm
+   Name > Services > OAuth2 Provider > Advanced and enable the Code Verifier
+   Parameter Required property, which is enabled by default.

The patch confirms the corrected behavior: when a code_challenge is present on the authorization code, the server now unconditionally requires the matching code_verifier at the token endpoint.

Detection Methods for CVE-2026-48717

Indicators of Compromise

• Token endpoint (/oauth2/access_token) requests that successfully redeem an authorization code without a code_verifier parameter
• Successful token issuance for authorization codes that were originally issued with a code_challenge
• Repeated token exchange attempts from IP addresses or user agents that differ from those that initiated the authorization request
• OAuth access or refresh tokens used from geolocations or clients inconsistent with the authenticated user

Detection Strategies

• Parse OpenAM OAuth2 access logs and correlate authorization requests containing code_challenge with subsequent token requests missing code_verifier
• Alert on any /oauth2/access_token call that completes with HTTP 200 while lacking the code_verifier form parameter
• Baseline the IP, user agent, and TLS fingerprint of the authorization request and compare against the token exchange request for the same code

Monitoring Recommendations

• Ingest OpenAM audit logs into a centralized SIEM or data lake for correlation across the OAuth authorization and token exchange flows
• Monitor for anomalous refresh token usage patterns following the token exchange, including access from new devices or regions
• Track configuration state of the codeVerifierEnforced realm setting and alert on any changes

How to Mitigate CVE-2026-48717

Immediate Actions Required

• Upgrade OpenAM to version 16.1.1 or later, which enforces per-code PKCE validation regardless of realm settings
• Enable the Code Verifier Parameter Required property under Realms > Realm Name > Services > OAuth2 Provider > Advanced as a compensating control on unpatched instances
• Revoke active OAuth authorization codes, access tokens, and refresh tokens issued to public clients during the exposure window
• Audit OAuth2 client registrations and remove or restrict clients that no longer require access

Patch Information

The fix is available in OpenAM 16.1.1. Technical details are documented in the GHSA-4v2w-2wqp-mc85 security advisory and the upstream commit 97a34d9. The patch also enables the Code Verifier Parameter Required setting by default.

Workarounds

• Enable Code Verifier Parameter Required on every realm hosting OAuth2 Provider services to force PKCE enforcement globally
• Restrict OAuth2 redirect URIs to exact-match HTTPS endpoints under organizational control to limit code interception opportunities
• Reduce authorization code lifetime to the minimum practical value to shrink the redemption window
• Require mutual TLS or strong client authentication for confidential clients to raise the bar for token exchange abuse

# Compensating configuration (via OpenAM ssoadm) to enforce PKCE globally
ssoadm set-attr-defs \
  --servicename OAuth2Provider \
  --schematype Organization \
  --attributevalues forceclaimsinidtoken=true \
                    codeVerifierEnforced=true

# Confirm the setting is applied on the target realm
ssoadm get-realm-svc-attrs \
  --realm /myrealm \
  --servicename OAuth2Provider | grep codeVerifierEnforced