CVE-2026-48717

OpenAM (Open Access Management) versions before 16.1.1 fail to enforce the PKCE code_verifier during authorization code redemption unless the realm-wide codeVerifierEnforced flag is enabled, which is disabled by default. As a result, an attacker who intercepts a PKCE-protected authorization code (e.g., via referrer leakage, logs, or network interception) can redeem it at the token endpoint by simply omitting the code_verifier parameter entirely, while an explicitly incorrect verifier is still rejected. Successful exploitation yields the tokens issued for that code — effectively hijacking the victim's authenticated session and impersonating them in applications relying on the OpenAM identity provider. All deployments prior to 16.1.1 are vulnerable; public OAuth clients are directly affected, while confidential-client exploitation additionally requires the attacker to hold client authentication material or another redemption context. The flaw (CWE-285, CVSS 4.0 9.1 critical) is fixed in version 16.1.1, and there is currently no public proof of concept and no evidence of exploitation in the wild.

What to do: Upgrade to OpenAM 16.1.1 or later as the primary fix. Until then, enable the realm-wide codeVerifierEnforced setting so the token endpoint always requires a code_verifier, and verify that clients issued authorization codes with a code_challenge are actually validating it. Review token-endpoint logs for redemptions of PKCE-issued authorization codes that omit the code_verifier parameter, and rotate client secrets and review issued tokens if any such redemptions are found.