CVE-2026-47426 json
OpenAM OAuth Client Impersonation via JWKS Resolver Cache
published 2026-06-29 4 mo ago modified 2026-10-28 11 d ago also GHSA-f2cx-463q-7m2c , EUVD-2026-78368
- cvss
- 7.6
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 46%
- public exploits
- 0
- none known
Summary
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the private_key_jwt client authentication path uses ClientJwksResolverCache without reliably binding a cached jwks_uri resolver and verified assertion to the expected clientID in ClientCredentialsReader. An attacker controlling any registered client with published keys, including one obtained through open dynamic registration when enabled, can authenticate as another client whose keys are exposed through jwks_uri and mint tokens in that client's name across realms in the same OpenAM process. This issue is fixed in version 16.1.1.
Patch / fix
- maven org.openidentityplatform.openam:openam-oauth2 16.1.1
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 52 d ago
Exploit prediction
0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.6 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 7.6 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.openidentityplatform.openam:openam-oauth2 | <16.1.1 |
16.1.1 |
Affected products
- OpenIdentityPlatform OpenAM
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
-
github.com
/OpenIdentityPlatform/OpenAM/commit/91acaf499162097ec83bcd729275ba7a12e1bd21
web
-
github.com
/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-f2cx-463q-7m2c
web
-
github.com
/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-47426
advisory
-
github.com
/OpenIdentityPlatform/OpenAM
package
Sources
- CVE List CVE-2026-47426
- GitHub Advisory GHSA-f2cx-463q-7m2c
- NVD CVE-2026-47426
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.