GHSA-F2CX-463Q-7M2C高危已审查

OpenAM OAuth Client Impersonation via JWKS Resolver Cache

OSV 1.4.0 · github-reviewed · 修改于 2026-06-30 01:44

发布时间

2026-06-30 01:44

GitHub 审查时间

2026-06-30 01:44

NVD 发布时间

—

源文件

advisories/github-reviewed/2026/06/GHSA-f2cx-463q-7m2c/GHSA-f2cx-463q-7m2c.json

公告说明

Summary

Description

An Improper Authentication (CWE-287) issue in OpenAM's OAuth2 private_key_jwt client authentication path allows any registered OAuth2 client to mint tokens in the name of any other client whose key is published via a jwks_uri, without knowing the victim's signing key. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1.

Impact

OpenAM Community Edition deployments through version 16.0.6 that have OAuth2 clients configured for private_key_jwt authentication with keys published via jwks_uri are potentially affected. An attacker holding any such client registration, their own, or one obtained through open dynamic client registration where enabled, can mint access tokens in any other such client's name, in any realm hosted by the OpenAM process.

Patch

This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.

受影响的软件包

Maven

org.openidentityplatform.openam:openam-oauth2

标识信息

别名 / CVE

CVE-2026-47426

CWE

CWE-287

软件生态

Maven

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V4

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

原始 OSV JSON

{
  "id": "GHSA-f2cx-463q-7m2c",
  "aliases": [
    "CVE-2026-47426"
  ],
  "details": "## Summary\n\n**Description**\n\nAn Improper Authentication (CWE-287) issue in OpenAM's OAuth2 private_key_jwt client authentication path allows any registered OAuth2 client to mint tokens in the name of any other client whose key is published via a jwks_uri, without knowing the victim's signing key. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1.\n\n## Impact\n\nOpenAM Community Edition deployments through version 16.0.6 that have OAuth2 clients configured for private_key_jwt authentication with keys published via jwks_uri are potentially affected. An attacker holding any such client registration, their own, or one obtained through open dynamic client registration where enabled, can mint access tokens in any other such client's name, in any realm hosted by the OpenAM process.\n\n## Patch\nThis has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.",
  "summary": "OpenAM OAuth Client Impersonation via JWKS Resolver Cache",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "16.1.1"
            }
          ]
        }
      ],
      "package": {
        "name": "org.openidentityplatform.openam:openam-oauth2",
        "ecosystem": "Maven"
      },
      "database_specific": {
        "last_known_affected_version_range": "<= 16.0.6"
      }
    }
  ],
  "modified": "2026-06-29T17:44:37Z",
  "severity": [
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
    }
  ],
  "published": "2026-06-29T17:44:37Z",
  "references": [
    {
      "url": "https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-f2cx-463q-7m2c",
      "type": "WEB"
    },
    {
      "url": "https://github.com/OpenIdentityPlatform/OpenAM",
      "type": "PACKAGE"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2026-06-29T17:44:37Z"
  }
}