CVE-2026-123549
OpenIdentityPlatform OpenAM
Published 8 Nov 2026 · updated 8 Nov 2026 · Received
9.3 Critical · CVSS 4.0, vulncheck.com
Description
OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, allowing anonymous attackers to set restricted attributes including group membership. Attackers can register through the legacy self-service REST endpoint or User Self-Service flow to join administrative groups and gain full administrative control of OpenAM.