N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-64099

CVE-2025-64099: OpenAM: Using arbitrary OIDC requested claims values in id_token and user_info is allowed

Summary

If the "claims_parameter_supported" parameter is activated, it is possible through the "oidc-claims-extension.groovy" script, to inject the value of choice into a claim contained in the id_token or in the user_info. Authorization function requests do not prevent a claims parameter containing a JSON file to be injected. This JSON file allows users to customize claims returned by the "id_token" and "user_info" files. This allows for a very wide range of vulnerabilities depending on how clients use claims. For example, if some clients rely on an email field to identify a user, users can choose to entera any email address, and therefore assume any chosen identity.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-64099

CVE-2025-64099:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.openidentityplatform.openam:openam-oauth2	maven	< 16.0.3	16.0.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the oidc-claims-extension.groovy script, which allows an attacker to inject arbitrary values into OIDC claims. The root cause is the attributeRetriever closure within this script, which fails to validate user-provided claim values against the user's actual identity. The patch addresses this by comparing the requested claim value with the value retrieved from the user's identity and rejecting any mismatches.

The analysis of the patch file openam-scripting/src/main/groovy/oidc-claims-extension.groovy reveals the exact code change that fixes the vulnerability. The old code would accept any requested claim value if only one was provided. The new code validates the requested value against the user's identity.

Furthermore, a new log message introduced in the patch (logger.warning("OpenAMScopeValidator.getUserInfo(): ...")) strongly suggests that the org.forgerock.openam.oauth2.OpenAMScopeValidator.getUserInfo Java method is the entry point that executes the vulnerable Groovy script. Therefore, both the Groovy closure and the calling Java method are relevant for identifying the vulnerability in a runtime environment.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.