CVE-2026-123545

HIGH 7.1

OpenAM 14.5.1 before 16.1.4 CSRF in OAuth 2.0 Device Flow

CVSS Score

7.1

EPSS Score

0.0%

EPSS Percentile

0th

OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device authorization flow that allows attackers to approve device codes when consent is skipped for implied-consent clients. Attackers can start a device authorization and lure a logged-in user to a crafted page, obtaining access and ID tokens to call APIs as that user.

CWE	CWE-352
Vendor	openidentityplatform
Product	openam
Published	Nov 8, 2026

Stay Ahead of the Next One

Get instant alerts for openidentityplatform openam

Be the first to know when new high vulnerabilities affecting openidentityplatform openam are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Affected Versions

OpenIdentityPlatform / OpenAM

14.5.1 < 16.1.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-545c-rm35-2jj2 vulncheck.com: https://www.vulncheck.com/advisories/openam-14.5.1-before-16.1.4-csrf-in-oauth-2.0-device-flow

Credits

🔍 santhreal vharseko maximthomas tsujiguchitky