Critical 9.8

OpenAM before 16.1.4 Privilege Escalation via Self-Registration Attribute Bypass

CVE-2026-123549 First seen on SecPulse Nov 8, 10:37

Affected packages

Ecosystem	Package	Affected → Fixed	Fixed
OpenIdentityPlatform	OpenIdentityPlatformOpenAM	< 16.1.4→ 16.1.4	16.1.4

Original description The description as published by the source.

OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, allowing anonymous attackers to set restricted attributes including group membership. Attackers can register through the legacy self-service REST endpoint or User Self-Service flow to join administrative groups and gain full administrative control of OpenAM.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Critical 9.8; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4: Critical 9.3; CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Published: Nov 8, 2026
First seen on SecPulse: Nov 8, 10:37
GHSA: GHSA-jv8f-m88g-h6mm
CWE: CWE-269

NVD GitHub Advisory

Tags(click for explanation)

Attack Types

Privilege Escalation

CWE

CWE-269

All

Openidentityplatform Openam

Detection sources

OSV.dev (Open Source Vulnerabilities)Nov 9, 11:47
NIST National Vulnerability Database07:13
GitHub Security Advisories (Global)Nov 8, 12:30
CVE.org (CVE Program・cvelistV5)Nov 8, 10:37