CVE-2026-45052

Open Access Management (OpenAM) versions prior to 16.1.1 contain an improper authorization flaw (CWE-285) in the Liberty Web Services (ID-WSF) SOAP receiver: the SOAPReceiver and DiscoveryService handlers accept unauthenticated remote requests and write persistent entries into a user's Liberty Discovery store and the shared root-realm Discovery branch. The server-side handlers bypass requester LDAP and identity ACLs, and the global path operates with an internal administrative token, so no credentials or user interaction are required (CVSS 4.0: 9.3, critical). An attacker gains the ability to plant or manipulate service-routing and security-mechanism records, and any deployment that consumes Liberty discovery data can subsequently act on attacker-controlled records, undermining downstream authentication and service-routing decisions. Organizations self-hosting OpenAM releases before 16.1.1 that have the Liberty web services endpoints reachable are affected; the issue is fixed in version 16.1.1. There is no known public proof of concept and no evidence of exploitation in the wild (not in CISA KEV).

What to do: Upgrade to OpenAM 16.1.1 or later, which fixes the flaw. Until patched, block or restrict external access to the Liberty Web Services SOAPReceiver and DiscoveryService endpoints at the reverse proxy or WAF, since they should never face untrusted networks. Audit the shared root-realm Discovery branch and user Liberty Discovery stores for unexpected service-routing or security-mechanism entries, and verify whether any downstream consumers rely on Liberty discovery data that may have been tampered with.