{"cve":"CVE-2026-46623","nvd":{"published":"2026-09-15T10:17:04.920","modified":"2026-09-23T18:19:19.803","status":"Awaiting Analysis","description":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth2 authentication module updates an existing local account with profile attributes that can include userPassword and inetUserStatus, rewriting the password to the username and reactivating disabled accounts. The missing OAuth.removeRestrictedAccountUpdateAttributes filtering permits these credential and status fields to reach the account update. With account creation enabled, repeated OAuth login causes the default ldapService chain to accept the username as both identifier and password, allowing an unauthenticated attacker to take over the local account without interacting with the identity provider. The rewrite can be denied for usernames shorter than the configured minimum password length. This issue is fixed in version 16.1.1.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":7.4},"cvss_v3":null,"cwes":["CWE-620","CWE-1391"],"references":["https://github.com/OpenIdentityPlatform/OpenAM/commit/7993f6d2121c915a473415302b4c939e34b2842f","https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1","https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-gf57-4mp6-m85x"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:53:43.293028046+00:00"},"epss":{"cve":"CVE-2026-46623","score":0.00669,"percentile":0.5197,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-gf57-4mp6-m85x","url":"https://osv.dev/vulnerability/GHSA-gf57-4mp6-m85x","summary":"OpenAM Account Takeover via Unverified Password Change in OAuth2 Module","modified":"2026-10-28T15:45:09.857355832Z","packages":[{"ecosystem":"Maven","name":"org.openidentityplatform.openam:openam-auth-oauth2","purl":"pkg:maven/org.openidentityplatform.openam/openam-auth-oauth2","ranges":["<16.1.1"],"fixed":["16.1.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}