CVEsOpenIdentityPlatformCVE-2026-46560Published Oct 30, 18:36 · Updated Oct 30, 18:36 UTC
7.5
HighCVSS 3.1 · from GitHub_M
CVE-2026-46560

OpenAM Authentication Bypass via RADIUS Spoofing

OpenAM · CWE-347 · CWE-347
AffectedOpenAM
FixNo fix listed yet.
PublishedOct 30, 18:36 · GitHub_M
ScoredOct 30 · 7.5 · GitHub_M
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:07 UTC

What we know

No known exploitation. CISA KEV, checked 22:07 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker has to be on the same network. CVSS: adjacent network.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.

Description

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `RADIUS` authentication module opens an unconnected datagram socket and trusts the first UDP datagram received on the client source port. The receive path does not verify the source IP and port, match the response identifier to the outstanding request, or verify the RFC 2865 `Response Authenticator`; the RFC 2869 `Message-Authenticator` is neither sent nor required. Any non-Reject/non-Challenge packet is treated as success. On a deployment with a `RADIUS` module instance enabled on a login chain, an unauthenticated network attacker can race the real server on-path or spray forged `Access-Accept` packets off-path and obtain a session for any `RADIUS`-mapped username without knowing the shared secret. Unlike CVE-2024-3596, exploitation requires no MD5 chosen-prefix forgery because no response authenticator is checked. The resulting session carries the impersonated principal's privileges. This issue is fixed in version 16.1.1.

From GitHub_M

Affected and fixed versions

ProductAffectedFixed inOpenAM< 16.1.1–

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-386j-6m86-78f9 · github.comrefsource_CONFIRMgithub.com/OpenIdentityPlatform/OpenAM/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775 · github.comrefsource_MISCgithub.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1 · github.comrefsource_MISC

Other CVEs in OpenAM

All 32 →
8.3OpenAM Session Hijacking via CDSSO · CVE-2026-45049Oct 295.4OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri · CVE-2026-105122Oct 34.9OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping · CVE-2026-105121Oct 3