---
id: CVE-2026-46623
title: Open Access Management (OpenAM) is an access management solution
summary: >-
  Open Access Management (OpenAM) is an access management solution. Prior to
  16.1.1, the OAuth2 authentication module updates an existing local account
  with profile attributes that can include userPassword and inetUserStatus,
  rewriting the…
severity: high
cvss: 7.4
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-620
  - CWE-1391
vendor: OpenIdentityPlatform
product: OpenAM
affected:
  - OpenAM < 16.1.1
patched:
  - 'org.openidentityplatform.openam:openam-auth-oauth2 16.1.1'
published: '2026-09-15'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T18:19:19.803'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-46623'
references:
  - url: >-
      https://github.com/OpenIdentityPlatform/OpenAM/commit/7993f6d2121c915a473415302b4c939e34b2842f
    label: security-advisories@github.com
  - url: 'https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-gf57-4mp6-m85x
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-gf57-4mp6-m85x'
tags:
  - nvd
  - cve.org
  - ghsa
  - maven
epss: 0.00669
epssPercentile: 0.49773
ecosystem: maven
cvssSource: cna
ingestedAt: '2026-06-29T13:24:35.293Z'
---

## Overview

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth2 authentication module updates an existing local account with profile attributes that can include userPassword and inetUserStatus, rewriting the password to the username and reactivating disabled accounts. The missing OAuth.removeRestrictedAccountUpdateAttributes filtering permits these credential and status fields to reach the account update. With account creation enabled, repeated OAuth login causes the default ldapService chain to accept the username as both identifier and password, allowing an unauthenticated attacker to take over the local account without interacting with the identity provider. The rewrite can be denied for usernames shorter than the configured minimum password length. This issue is fixed in version 16.1.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-46623)

Affected packages:

- `org.openidentityplatform.openam:openam-auth-oauth2 < 16.1.1`

Patched in:

- `org.openidentityplatform.openam:openam-auth-oauth2 16.1.1`

Source: https://github.com/advisories/GHSA-gf57-4mp6-m85x