Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M

CVE-2026-47426OpenAM OAuth Client Impersonation via JWKS Resolver Cache

High 7.6

In plain English

A high-severity improper authentication in OpenAM from OpenIdentityPlatform. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.6High

Exploit odds (30 days)0.6%top 53.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the private_key_jwt client authentication path uses ClientJwksResolverCache without reliably binding a cached jwks_uri resolver and verified assertion to the expected clientID in ClientCredentialsReader. An attacker controlling any registered client with published keys, including one obtained through open dynamic registration when enabled, can authenticate as another client whose keys are exposed through jwks_uri and mint tokens in that client's name across realms in the same OpenAM process. This issue is fixed in version 16.1.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.openidentityplatform.openam:openam-oauth2	16.1.1	GHSA-f2cx-463q-7m2c

Affected products (as reported)

Vendor	Product	Versions
OpenIdentityPlatform	OpenAM	< 16.1.1

Weakness: CWE-287 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-f2cx-463q-7m2c x_refsource_CONFIRM
https://github.com/OpenIdentityPlatform/OpenAM/commit/91acaf499162097ec83bcd729275ba7a12e1bd21 x_refsource_MISC
https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1 x_refsource_MISC