Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

OpenAM lets attackers become admins through self‑registration

CVE-2026-123549 · published today
Summary

The OpenAM system, versions before 16.1.4, does not properly check which user attributes can be set when a new account is created without authentication. This lets anyone on the Internet register an account and assign themselves privileged settings, such as membership in administrative groups, giving them full control of the system. Update OpenAM to version 16.1.4 or later, or apply the vendor's patch, to close the gap.

What to do
  • Update openidentityplatform openam to version 16.1.4 or later.
Affected software
VendorProductAffected versions
openidentityplatform openam < 16.1.4
Original advisory text
OpenAM before 16.1.4 Privilege Escalation via Self-Registration Attribute Bypass
OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, allowing anonymous attackers to set restricted attributes including group membership. Attackers can register through the legacy self-service REST endpoint or User Self-Service flow to join administrative groups and gain full administrative control of OpenAM.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.9 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-269Improper Privilege Management
Timeline
Published8 Nov 2026
Updated8 Nov 2026
First seen8 Nov 2026
Sources
CVE-2026-123549 · NVD
CVE-2026-123549 · MITRE
CVE-2026-123549 · OSV
GHSA-jv8f-m88g-h6mm · GHSA
Track software like this
Free during beta