4.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48717

CVE-2026-48717: OpenAM OAuth Authorization Bypass via PKCE Challenge

Summary

Description

An Improper Authorization (CWE-285) issue in OpenAM's OAuth2 authorization-code grant allows a PKCE-protected authorization code to be redeemed without the required code_verifier. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1.

The authorize endpoint stores a code_challenge on the issued code, but the token endpoint only requires a code_verifier when the realm-wide codeVerifierEnforced setting is enabled, which ships disabled by default. With that setting off, the stored challenge is checked only if the caller supplies a verifier, so omitting the parameter skips PKCE verification entirely.

Impact

OpenAM Community Edition deployments through version 16.0.6 using the default OAuth2 provider configuration are potentially affected. For public clients, an attacker who intercepts an authorization code can exchange it for tokens without knowing the verifier. For confidential clients, the attacker additionally needs client authentication material or an execution context that can redeem the code. A token request supplying an incorrect verifier is still rejected. The bypass is specifically the missing-parameter path.

Patch

This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48717

CVE-2026-48717:

4.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.openidentityplatform.openam:openam-oauth2	maven	<= 16.0.6	16.1.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the handle method of the org.forgerock.oauth2.core.AuthorizationCodeGrantTypeHandler class. In vulnerable versions, this method was responsible for exchanging an authorization code for an access token. When a client uses PKCE, it provides a code_challenge in the authorization request, and OpenAM stores this challenge with the authorization code. When the client later redeems the code at the token endpoint, it must provide a code_verifier.

The vulnerability existed because the handle method only enforced the code_verifier check under two conditions:

A global setting, codeVerifierEnforced, was enabled for the realm. This was false by default.
The client voluntarily included the code_verifier parameter in the token request.

If the global setting was disabled and an attacker intercepted a PKCE-protected authorization code, they could simply make a request to the token endpoint without the code_verifier parameter. The vulnerable code (if (codeVerifier != null)) would see the missing parameter and skip the PKCE validation entirely, issuing an access token.

The patch corrects this logic. It introduces a check, codeWasIssuedWithChallenge, which is true if the authorization code was originally issued with a code_challenge. The validation logic is changed to if (providerSettings.isCodeVerifierRequired() || codeWasIssuedWithChallenge), ensuring that if a code_challenge was ever associated with the code, the code_verifier is now mandatory. Furthermore, the check that calls the verifier function was changed from if (codeVerifier != null) to if (codeWasIssuedWithChallenge), ensuring the check is always performed for PKCE codes, and will fail if the verifier is missing. This correctly enforces the PKCE flow as described in RFC 7636, preventing the authorization bypass. The fix also changes the default for the provider-wide enforcement to true as a defense-in-depth measure.

Vulnerable functions

org.forgerock.oauth2.core.AuthorizationCodeGrantTypeHandler.handle

openam-oauth2/src/main/java/org/forgerock/oauth2/core/AuthorizationCodeGrantTypeHandler.java

The `handle` function was vulnerable because it did not enforce the presentation of a `code_verifier` if one was not provided in the request, even if the original authorization code was issued with a `code_challenge`. This allowed an attacker to bypass the PKCE protection by simply omitting the `code_verifier` parameter from the token request. The patch fixes this by explicitly checking if a `code_challenge` was associated with the authorization code and enforcing the `code_verifier` check in that case, regardless of whether the parameter is present in the request.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.