{"id":"CVE-2026-123549","published":"2026-11-08T02:16:46.247","lastModified":"2026-11-10T22:13:29.767","description":"OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, allowing anonymous attackers to set restricted attributes including group membership. Attackers can register through the legacy self-service REST endpoint or User Self-Service flow to join administrative groups and gain full administrative control of OpenAM.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-jv8f-m88g-h6mm","tags":[]},{"url":"https://www.vulncheck.com/advisories/openam-before-16.1.4-privilege-escalation-via-self-registration-attribute-bypass","tags":[]}],"exploitRefs":[{"url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-jv8f-m88g-h6mm","tags":[]}],"hasPoc":true,"ai":{"summary":"OpenAM versions before 16.1.4 do not enforce the Valid Creation Attributes list during self-registration, permitting anonymous users to set restricted attributes like group membership via the legacy self-service REST endpoint or User Self-Service flow. This allows attackers to assign themselves administrative group membership and gain full control of the OpenAM instance.","exploitability":"Exploitation is trivial for anonymous attackers with network access to the affected endpoints; no authentication, user interaction, or special conditions are required.","blast_radius":"Successful exploitation grants full administrative control over OpenAM, enabling attackers to modify authentication policies, steal credentials, impersonate users, and compromise all systems integrated with OpenAM for SSO.","remediation":"Upgrade to OpenAM 16.1.4 or later immediately; if upgrading is not feasible, disable the legacy self-service REST endpoint and restrict access to the User Self-Service flow until patched.","detection":"Defenders should monitor authentication logs for self-registration events where the 'groups' or 'memberOf' attribute is set during registration, especially from anonymous IP addresses or with administrative group names (e.g., 'am-admins', 'Super Users').","tags":["auth-bypass","privilege-escalation","web","ssr","identity-management"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:46:15.515Z"}}