CVE-2026-47426

Open Access Management (OpenAM) versions prior to 16.1.1 contain an improper authentication flaw (CWE-287) in the private_key_jwt OAuth2/OIDC client authentication path: ClientJwksResolverCache does not reliably bind the cached jwks_uri resolver and the verified assertion to the expected clientID in ClientCredentialsReader. An attacker who controls any registered client with published keys — potentially one obtained through open dynamic client registration if that feature is enabled — can authenticate as a different client whose keys are exposed via jwks_uri and mint tokens in that victim client's name, even across realms hosted in the same OpenAM process. The impact is high confidentiality and integrity compromise of the OAuth token issuance flow (CVSS 4.0: 7.6), letting the attacker obtain valid tokens masquerading as other clients and access resources those clients are entitled to. All deployments running OpenAM older than 16.1.1 that use private_key_jwt client authentication are affected. No public proof-of-concept exists, the issue is not in CISA's KEV, and no in-the-wild exploitation is known.

What to do: Upgrade to OpenAM 16.1.1 or later, which fixes the clientID-binding flaw in the JWKS resolver cache. If immediate upgrade is not possible, disable or restrict open dynamic client registration so untrusted parties cannot register attacker-controlled clients, and review OAuth2 audit logs for tokens issued via private_key_jwt under clientIDs from unexpected realms. After patching, rotate keys/credentials for clients that use jwks_uri and private_key_jwt authentication.