CVE-2026-105117 OpenIdentityPlatform CVE debrief

Who should care

Defenders responsible for OpenAM deployments should assess exposure and prioritize verification and remediation. This includes reviewing OpenAM versions, restricting access to user self-service actions, and monitoring for suspicious email activity. Operators, platform administrators, vulnerability management teams, and security teams should review the vulnerability and take necessary actions to protect their systems.

Why it matters

CVE-2026-105117 is an email content injection vulnerability in OpenAM before 16.1.3 that allows unauthenticated attackers to control notification email wording, potentially leading to phishing attacks. Defenders responsible for OpenAM deployments should assess exposure and prioritize verification and remediation.

• Potential phishing attacks using organization's configured From address
• Abuse of register action as a relay to arbitrary recipients
• Verification of OpenAM versions and user self-service action restrictions
• Monitoring for suspicious email activity

Technical summary

CVE-2026-105117 is an email content injection vulnerability in OpenAM before 16.1.3. Attackers can use the forgotPassword and register actions to control notification email wording, potentially leading to phishing attacks. The vulnerability allows unauthenticated attackers to control notification email wording via the forgotPassword and register actions on /json/{realm}/users, which can be used for phishing attacks or as a relay to arbitrary recipients. Defenders should prioritize verifying OpenAM versions and restricting access to user self-service actions.

Defensive priority

Defenders should prioritize verifying OpenAM versions and restricting access to user self-service actions.

Recommended defensive actions

• Verify OpenAM version and apply patches if necessary
• Restrict access to user self-service actions
• Monitor for suspicious email activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Additional information on affected versions and remediation is needed. OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control notification email wording via the forgotPassword and register actions on /json/{realm}/users.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.