Vulnerabilities

OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device authorization flow that allows attackers…

OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device authorization flow that allows attackers to approve device codes when consent is skipped for implied-consent clients. Attackers can start a device authorization and lure a logged-in user to a crafted page, obtaining access and ID tokens to call APIs as that user.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

OpenIdentityPlatform

Product

OpenAM

CVSS v3.1

7.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Weakness

CWE-352

Exposure class

Identity

NVD status

Received

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-123545 on this site · NVD · CVE.org · Vulnpedia