{"items":[{"id":"NVI-00009068","kind":"vulnerability","title":"OpenAM Arbitrary OAuth Token Minting via Push Registration","revision":5,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-cj8f-2fhf-826r","CVE-2026-46498"],"plain_summary":"GitHub lists this reviewed advisory for org.openidentityplatform.openam:openam-oauth2. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-06262bc7ce35973a0fa83cc686154989"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-23T18:21:42.327Z","value":"7.6 HIGH (4.0)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-792f49ac3e200fcb19c37327e068fbc8"},{"kind":"EPSS","as_of":"2026-11-05T12:03:04.000Z","value":"0.414%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.35838. Missing scores are unknown.","source_id":"sr-06262bc7ce35973a0fa83cc686154989"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-9b55e6c5e2db00c6a2e884c465d6c17a","url":"https://github.com/advisories/GHSA-cj8f-2fhf-826r","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-cj8f-2fhf-826r","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:36.327Z"},{"id":"sr-792f49ac3e200fcb19c37327e068fbc8","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46498","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-46498","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-03T22:35:28.075Z"},{"id":"sr-06262bc7ce35973a0fa83cc686154989","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-46498","publisher":"FIRST EPSS","observed_at":"2026-11-06T00:24:57.658Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-9b55e6c5e2db00c6a2e884c465d6c17a"],"technology":"org.openidentityplatform.openam:openam-oauth2","known_exclusions":[],"conditions_summary":"## Summary\n\n**Description**\n\nAn Authorization Bypass Through User-Controlled Key (CWE-639) exists in OpenAM's stateful OAuth2 token-read path. Under certain conditions, this may allow an attacker to forge OAuth2 bearer tokens and OIDC ID tokens with arbitrary subject, client, realm, and scope. This affects OpenAM Community Edition through version 16.0.6.\n\nThe OAuth2 token-read path reads caller-supplied token identifiers from the shared Core Token Store (CTS) without placing them in an OAuth-only namespace and without binding the row's trusted CTS type to the expected OAuth token family, so any CTS row whose BLOB claims to be an OAuth token is accepted on the read path with no integrity check.\n\n## Impact\n\nOpenAM Community Edition deployments through version 16.0.6 with the OAuth2 Provider service enabled in a realm are potentially affected, but the vulnerable read path is only reachable once an attacker can place attacker-controlled JSON into the shared CTS under an identifier they know. For example, an anonymous Push Notification SNS callback handler, reachable by any low-privileged user in a Push Notification-enabled realm after a single legitimate Push registration can trigger t","public_affected_ranges":["< 16.1.1"]}],"null_published_at":"2026-11-08T15:11:49.358Z","source_updated_at":"2026-10-28T15:27:30.000Z","source_disclosed_at":"2026-06-25T17:07:58.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:56:36.327Z"},{"id":"NVI-00009068","kind":"vulnerability","title":"OpenAM Arbitrary OAuth Token Minting via Push Registration","revision":4,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-cj8f-2fhf-826r","CVE-2026-46498"],"plain_summary":"GitHub lists this reviewed advisory for org.openidentityplatform.openam:openam-oauth2. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-06262bc7ce35973a0fa83cc686154989"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-11-05T12:03:04.000Z","value":"0.414%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.35838. Missing scores are unknown.","source_id":"sr-06262bc7ce35973a0fa83cc686154989"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-9b55e6c5e2db00c6a2e884c465d6c17a","url":"https://github.com/advisories/GHSA-cj8f-2fhf-826r","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-cj8f-2fhf-826r","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:36.327Z"},{"id":"sr-06262bc7ce35973a0fa83cc686154989","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-46498","publisher":"FIRST EPSS","observed_at":"2026-11-06T00:24:57.658Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-9b55e6c5e2db00c6a2e884c465d6c17a"],"technology":"org.openidentityplatform.openam:openam-oauth2","known_exclusions":[],"conditions_summary":"## Summary\n\n**Description**\n\nAn Authorization Bypass Through User-Controlled Key (CWE-639) exists in OpenAM's stateful OAuth2 token-read path. Under certain conditions, this may allow an attacker to forge OAuth2 bearer tokens and OIDC ID tokens with arbitrary subject, client, realm, and scope. This affects OpenAM Community Edition through version 16.0.6.\n\nThe OAuth2 token-read path reads caller-supplied token identifiers from the shared Core Token Store (CTS) without placing them in an OAuth-only namespace and without binding the row's trusted CTS type to the expected OAuth token family, so any CTS row whose BLOB claims to be an OAuth token is accepted on the read path with no integrity check.\n\n## Impact\n\nOpenAM Community Edition deployments through version 16.0.6 with the OAuth2 Provider service enabled in a realm are potentially affected, but the vulnerable read path is only reachable once an attacker can place attacker-controlled JSON into the shared CTS under an identifier they know. For example, an anonymous Push Notification SNS callback handler, reachable by any low-privileged user in a Push Notification-enabled realm after a single legitimate Push registration can trigger t","public_affected_ranges":["< 16.1.1"]}],"null_published_at":"2026-11-07T07:07:46.834Z","source_updated_at":"2026-10-28T15:27:30.000Z","source_disclosed_at":"2026-06-25T17:07:58.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:56:36.327Z"},{"id":"NVI-00009068","kind":"vulnerability","title":"OpenAM Arbitrary OAuth Token Minting via Push Registration","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-cj8f-2fhf-826r","CVE-2026-46498"],"plain_summary":"GitHub lists this reviewed advisory for org.openidentityplatform.openam:openam-oauth2. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-1b2c4cf7a383cc818bd49b448c465e5c"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-11-01T12:00:16.000Z","value":"0.414%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.35662. Missing scores are unknown.","source_id":"sr-1b2c4cf7a383cc818bd49b448c465e5c"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-9b55e6c5e2db00c6a2e884c465d6c17a","url":"https://github.com/advisories/GHSA-cj8f-2fhf-826r","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-cj8f-2fhf-826r","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:36.327Z"},{"id":"sr-1b2c4cf7a383cc818bd49b448c465e5c","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-46498","publisher":"FIRST EPSS","observed_at":"2026-11-01T14:28:32.280Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-9b55e6c5e2db00c6a2e884c465d6c17a"],"technology":"org.openidentityplatform.openam:openam-oauth2","known_exclusions":[],"conditions_summary":"## Summary\n\n**Description**\n\nAn Authorization Bypass Through User-Controlled Key (CWE-639) exists in OpenAM's stateful OAuth2 token-read path. Under certain conditions, this may allow an attacker to forge OAuth2 bearer tokens and OIDC ID tokens with arbitrary subject, client, realm, and scope. This affects OpenAM Community Edition through version 16.0.6.\n\nThe OAuth2 token-read path reads caller-supplied token identifiers from the shared Core Token Store (CTS) without placing them in an OAuth-only namespace and without binding the row's trusted CTS type to the expected OAuth token family, so any CTS row whose BLOB claims to be an OAuth token is accepted on the read path with no integrity check.\n\n## Impact\n\nOpenAM Community Edition deployments through version 16.0.6 with the OAuth2 Provider service enabled in a realm are potentially affected, but the vulnerable read path is only reachable once an attacker can place attacker-controlled JSON into the shared CTS under an identifier they know. For example, an anonymous Push Notification SNS callback handler, reachable by any low-privileged user in a Push Notification-enabled realm after a single legitimate Push registration can trigger t","public_affected_ranges":["< 16.1.1"]}],"null_published_at":"2026-11-04T18:04:03.094Z","source_updated_at":"2026-10-28T15:27:30.000Z","source_disclosed_at":"2026-06-25T17:07:58.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:56:36.327Z"},{"id":"NVI-00009068","kind":"vulnerability","title":"OpenAM Arbitrary OAuth Token Minting via Push Registration","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-cj8f-2fhf-826r","CVE-2026-46498"],"plain_summary":"GitHub lists this reviewed advisory for org.openidentityplatform.openam:openam-oauth2. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-4ff6584b5d0f4e81c8096f3d710371f3"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.414%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.3567. Missing scores are unknown.","source_id":"sr-4ff6584b5d0f4e81c8096f3d710371f3"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-9b55e6c5e2db00c6a2e884c465d6c17a","url":"https://github.com/advisories/GHSA-cj8f-2fhf-826r","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-cj8f-2fhf-826r","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:36.327Z"},{"id":"sr-4ff6584b5d0f4e81c8096f3d710371f3","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-46498","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:15.379Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-9b55e6c5e2db00c6a2e884c465d6c17a"],"technology":"org.openidentityplatform.openam:openam-oauth2","known_exclusions":[],"conditions_summary":"## Summary\n\n**Description**\n\nAn Authorization Bypass Through User-Controlled Key (CWE-639) exists in OpenAM's stateful OAuth2 token-read path. Under certain conditions, this may allow an attacker to forge OAuth2 bearer tokens and OIDC ID tokens with arbitrary subject, client, realm, and scope. This affects OpenAM Community Edition through version 16.0.6.\n\nThe OAuth2 token-read path reads caller-supplied token identifiers from the shared Core Token Store (CTS) without placing them in an OAuth-only namespace and without binding the row's trusted CTS type to the expected OAuth token family, so any CTS row whose BLOB claims to be an OAuth token is accepted on the read path with no integrity check.\n\n## Impact\n\nOpenAM Community Edition deployments through version 16.0.6 with the OAuth2 Provider service enabled in a realm are potentially affected, but the vulnerable read path is only reachable once an attacker can place attacker-controlled JSON into the shared CTS under an identifier they know. For example, an anonymous Push Notification SNS callback handler, reachable by any low-privileged user in a Push Notification-enabled realm after a single legitimate Push registration can trigger t","public_affected_ranges":["< 16.1.1"]}],"null_published_at":"2026-10-31T23:18:17.288Z","source_updated_at":"2026-10-28T15:27:30.000Z","source_disclosed_at":"2026-06-25T17:07:58.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:56:36.327Z"},{"id":"NVI-00009068","kind":"vulnerability","title":"OpenAM Arbitrary OAuth Token Minting via Push Registration","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-cj8f-2fhf-826r","CVE-2026-46498"],"plain_summary":"GitHub lists this reviewed advisory for org.openidentityplatform.openam:openam-oauth2. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-9b55e6c5e2db00c6a2e884c465d6c17a"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-9b55e6c5e2db00c6a2e884c465d6c17a","url":"https://github.com/advisories/GHSA-cj8f-2fhf-826r","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-cj8f-2fhf-826r","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:36.327Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-9b55e6c5e2db00c6a2e884c465d6c17a"],"technology":"org.openidentityplatform.openam:openam-oauth2","known_exclusions":[],"conditions_summary":"## Summary\n\n**Description**\n\nAn Authorization Bypass Through User-Controlled Key (CWE-639) exists in OpenAM's stateful OAuth2 token-read path. Under certain conditions, this may allow an attacker to forge OAuth2 bearer tokens and OIDC ID tokens with arbitrary subject, client, realm, and scope. This affects OpenAM Community Edition through version 16.0.6.\n\nThe OAuth2 token-read path reads caller-supplied token identifiers from the shared Core Token Store (CTS) without placing them in an OAuth-only namespace and without binding the row's trusted CTS type to the expected OAuth token family, so any CTS row whose BLOB claims to be an OAuth token is accepted on the read path with no integrity check.\n\n## Impact\n\nOpenAM Community Edition deployments through version 16.0.6 with the OAuth2 Provider service enabled in a realm are potentially affected, but the vulnerable read path is only reachable once an attacker can place attacker-controlled JSON into the shared CTS under an identifier they know. For example, an anonymous Push Notification SNS callback handler, reachable by any low-privileged user in a Push Notification-enabled realm after a single legitimate Push registration can trigger t","public_affected_ranges":["< 16.1.1"]}],"null_published_at":"2026-10-31T22:13:31.273Z","source_updated_at":"2026-10-28T15:27:30.000Z","source_disclosed_at":"2026-06-25T17:07:58.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:56:36.327Z"}],"next_cursor":null,"snapshot_revision":"42594"}