OpenAM before 16.1.4 Privilege Escalation via Self-Registration Attribute Bypass
Affects OpenAM releases up to and including 16.1.3 in realms where self-registration is enabled. Fixed in OpenAM 16.1.4.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 16.1.4
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Affects OpenAM releases up to and including 16.1.3. Self-registration must be enabled in the realm.
- Published
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 21/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, allowing anonymous attackers to set restricted attributes including group membership. Attackers can register through the legacy self-service REST endpoint or User Self-Service flow to join administrative groups and gain full administrative control of OpenAM.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure12/25Specific setups only, reachable over the network without a login
- Reach?/20Unknown. No tracked technology or package matched
- Severity9.3/10CVSS 9.3
- No patch0/5No signal
What would change the score
- Would score about 71 if added to CISA KEV
- Would score about 66 if CISA's SSVC rates exploitation active
What to do
Check whether your setup matches what the bug needs.
Affects OpenAM releases up to and including 16.1.3. Self-registration must be enabled in the realm.Upgrade to a fixed version: 16.1.4.
Workaround: Disable self-registration in every realm that does not need it.
Timeline
- CVE published
- First seen by cve.now
- Posted on X by cve.now
Affected versions
- OpenIdentityPlatform OpenAM
fixed in 16.1.4
Evidence 2
- Advisory
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-123549
Is CVE-2026-123549 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
A flaw in OpenAM's self-registration lets an anonymous user create an account that is a member of administrative groups. That can give full administrative control of OpenAM, including reading and changing identities and authentication, federation and OAuth2 settings, and creating more administrator accounts.Source: github.com
Which versions are affected by CVE-2026-123549?
OpenAM: before 16.1.4.Source: cve.now feed data
Am I affected, and how do I check?
All OpenAM releases up to and including 16.1.3 are affected, but only in realms where self-registration is enabled. To check, look up the installed OpenAM version and whether self-registration is turned on in each realm.Source: github.com
How do I fix CVE-2026-123549?
Upgrade to OpenAM 16.1.4, which contains the fix. Until the upgrade is done, disable self-registration in every realm that does not need it.Source: github.com