CVE-2026-46623
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth2 authentication module updates an existing local account with profile attributes that can include userPassword and inetUserStatus, rewriting the password to the username and reactivating disabled accounts. The missing OAuth.removeRestrictedAccountUpdateAttributes filtering permits these credential and status fields to reach the account update. With account creation enabled, repeated OAuth login causes the default ldapService chain to accept the username as both identifier and password, allowing an unauthenticated attacker to take over the local account without interacting with the identity provider. The rewrite can be denied for usernames shorter than the configured minimum password length. This issue is fixed in version 16.1.1.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.4
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.49%
- CWE
- CWE-620, CWE-1391
- Published
- 2026-09-15
- Last modified
- 2026-09-17
Affected products
- OpenIdentityPlatform OpenAM
Weakness type
Related vulnerabilities
- CVE-2024-12824 — Nokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Change
- CVE-2025-4322 — Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover
- CVE-2024-20419 — A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauth
- CVE-2025-1107 — Unverified password change vulnerability in Janto
- CVE-2024-33699 — The LevelOne WBR-6012 router's web application has a vulnerability in its firmware version R0.40e6, allowing attackers t
- CVE-2025-3603 — Flynax Bridge <= 2.2.0 - Unauthenticated Privilege Escalation via Password Update
- CVE-2024-12860 — CarSpot – Dealership Wordpress Classified Theme <= 2.4.3 - Unauthenticated Arbitrary Password Reset/Account Takeover
- CVE-2025-4558 — WormHole Tech GPM - Unverified Password Change