Summary
OpenAM Account Takeover via Unverified Password Change in OAuth2 Module
Description
An Unverified Password Change (CWE-620) and Use of Weak Credentials (CWE-1391) issue in OpenAM's OAuth2 authentication module silently rewrites a local user's password to the literal string of their username on OAuth2 re-login of an existing account. The default ldapService chain then accepts the username as the password for that user, allowing an unauthenticated attacker to obtain a session via the standard authenticate endpoint with both username and password set to the username, without any IdP interaction. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1.
Impact
OpenAM Community Edition deployments through version 16.0.6 that use the OAuth2 authentication module with account creation enabled (the default) are potentially affected. After two OAuth logins of a given user, that user's local password becomes their username, and the account is reachable through the default ldapService chain with username as both identifier and password. For pre-existing users whose IdP profile resolves against an existing local identifier, the rewrite fires on the very first re-login.
Usernames shorter than the default minimum password length have the rewrite silently denied (so very short administrative accounts are not affected), and the same update path marks accounts active on every OAuth login, silently reactivating disabled accounts.
Successful exploitation grants an unauthenticated attacker a session carrying the victim principal's privileges.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.
Frequently Asked Questions
- What is CVE-2026-46623? CVE-2026-46623 is a high-severity security vulnerability in org.openidentityplatform.openam:openam-auth-oauth2 (maven), affecting versions < 16.1.1. It is fixed in 16.1.1.
- Which versions of org.openidentityplatform.openam:openam-auth-oauth2 are affected by CVE-2026-46623? org.openidentityplatform.openam:openam-auth-oauth2 (maven) versions < 16.1.1 is affected.
- Is there a fix for CVE-2026-46623? Yes. CVE-2026-46623 is fixed in 16.1.1. Upgrade to this version or later.
- Is CVE-2026-46623 exploitable, and should I be worried? Whether CVE-2026-46623 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-46623 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-46623? Upgrade
org.openidentityplatform.openam:openam-auth-oauth2to 16.1.1 or later.