CVE-2026-46623

Open Access Management (OpenAM), the open-source access management platform, fails to strip restricted attributes in the OAuth2 authentication module before updating a local account, because the OAuth.removeRestrictedAccountUpdateAttributes filtering is missing. When account creation is enabled, repeated OAuth logins for an existing username cause the default ldapService chain to rewrite that account's userPassword to the username itself and to reactivate disabled accounts via the inetUserStatus attribute. An unauthenticated attacker who knows (or guesses) a victim's username can then log in locally with the username serving as both identifier and password, taking over the account without ever interacting with the identity provider. All deployments running versions prior to 16.1.1 with OAuth2 account creation/provisioning enabled are affected; the issue is fixed in OpenAM 16.1.1. No public proof-of-concept or known in-the-wild exploitation has been reported, and the flaw is not on the CISA KEV list.

What to do: Upgrade to OpenAM 16.1.1 as soon as possible. Until then, disable account creation in the OAuth2 authentication module and enforce a minimum password length longer than your maximum username length, since the password rewrite is denied for usernames shorter than the configured minimum. Also audit identity stores for accounts whose password matches their username and for previously disabled accounts (inetUserStatus changes) that were reactivated around OAuth login events.