CVE-2026-123542

MEDIUM 6.8

OpenAM before 16.1.4 PKCE Bypass in OAuth 2.0 Device Authorization Flow

CVSS Score

6.8

EPSS Score

0.0%

EPSS Percentile

0th

OpenAM before 16.1.4 fails to enforce PKCE in the OAuth 2.0 device authorization flow, never validating the code verifier when device codes are exchanged for tokens. Attackers who obtain an approved device code from client logs or shared device storage can redeem it for access and ID tokens to impersonate the user.

CWE	CWE-358
Vendor	openidentityplatform
Product	openam
Published	Nov 8, 2026

Stay Ahead of the Next One

Get instant alerts for openidentityplatform openam

Be the first to know when new medium vulnerabilities affecting openidentityplatform openam are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

OpenIdentityPlatform / OpenAM

0 < 16.1.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-h93p-35jm-rj83 vulncheck.com: https://www.vulncheck.com/advisories/openam-before-16.1.4-pkce-bypass-in-oauth-2.0-device-authorization-flow

Credits

🔍 manus-pi vharseko maximthomas tsujiguchitky 🔍 manus-use