CVE-2026-123549

Summary

OpenAM versions before 16.1.4 do not enforce the Valid Creation Attributes list during self-registration, permitting anonymous users to set restricted attributes like group membership via the legacy self-service REST endpoint or User Self-Service flow. This allows attackers to assign themselves administrative group membership and gain full control of the OpenAM instance.

Exploitability

Exploitation is trivial for anonymous attackers with network access to the affected endpoints; no authentication, user interaction, or special conditions are required.

Blast radius

Successful exploitation grants full administrative control over OpenAM, enabling attackers to modify authentication policies, steal credentials, impersonate users, and compromise all systems integrated with OpenAM for SSO.

Detection

Defenders should monitor authentication logs for self-registration events where the 'groups' or 'memberOf' attribute is set during registration, especially from anonymous IP addresses or with administrative group names (e.g., 'am-admins', 'Super Users').

Prioritized remediation

Upgrade to OpenAM 16.1.4 or later immediately; if upgrading is not feasible, disable the legacy self-service REST endpoint and restrict access to the User Self-Service flow until patched.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.