7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47426

CVE-2026-47426: OpenAM OAuth Client Impersonation via JWKS Resolver Cache

Summary

Description

An Improper Authentication (CWE-287) issue in OpenAM's OAuth2 private_key_jwt client authentication path allows any registered OAuth2 client to mint tokens in the name of any other client whose key is published via a jwks_uri, without knowing the victim's signing key. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1.

Impact

OpenAM Community Edition deployments through version 16.0.6 that have OAuth2 clients configured for private_key_jwt authentication with keys published via jwks_uri are potentially affected. An attacker holding any such client registration, their own, or one obtained through open dynamic client registration where enabled, can mint access tokens in any other such client's name, in any realm hosted by the OpenAM process.

Patch

This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-47426

CVE-2026-47426:

7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.openidentityplatform.openam:openam-oauth2	maven	<= 16.0.6	16.1.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in how OpenAM processed private_key_jwt client authentication assertions. The core issue is a failure to properly bind the identity of the client being authenticated to the cryptographic key used for validation. This was caused by two main flaws, which were fixed in the patch.

First, in ClientCredentialsReader.verifyJwtBearer, the code did not enforce the requirement from RFC 7523 that the JWT's iss (issuer) and sub (subject) claims must be identical for client authentication. It proceeded to look up the client registration based on the sub claim, even if the iss claim pointed to a different client.

Second, and more critically, in OpenAMClientRegistration.byJWKsURI, the mechanism for retrieving the JSON Web Key Set (JWKS) to validate the JWT signature was flawed. It used a shared cache of key resolvers keyed by the JWT's iss claim. This meant an attacker could register their own client, which would populate the cache with a resolver for their keys. Then, by crafting a JWT with their client ID as the iss and the victim's client ID as the sub, they could trick the system into using their own keys to validate an assertion for the victim's client.

The patch addresses both issues. It adds a strict check in ClientCredentialsReader.verifyJwtBearer to ensure iss equals sub. It also replaces the flawed shared resolver cache with a new cache, ClientJwksResolverCache, which keys resolvers by a combination of the client ID and its configured jwks_uri. This ensures that the keys used for validation are always the ones belonging to the client being authenticated, preventing the impersonation attack.

Vulnerable functions

org.forgerock.openam.oauth2.ClientCredentialsReader.verifyJwtBearer

openam-oauth2/src/main/java/org/forgerock/openam/oauth2/ClientCredentialsReader.java

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.