CVE-2026-105119 OpenIdentityPlatform CVE debrief

Who should care

Defenders responsible for OpenAM deployments, OAuth2 and OpenID Connect configurations, and security teams monitoring for suspicious authorization requests and token redemption attempts should assess exposure and prioritize verification and remediation.

Why it matters

Defenders should care about CVE-2026-105119 because it allows attackers to bypass PKCE enforcement in OpenAM before 16.1.3, potentially leading to token redemption through intercepted codes in OpenID Connect hybrid flows. This vulnerability requires verification and remediation priority for OpenAM deployments, especially for public clients and OAuth2 configurations.

• Potential token redemption by attackers through intercepted codes
• Bypass of PKCE enforcement in OpenID Connect hybrid flows
• Increased risk for public clients due to lack of bound challenges
• Verification priority for OpenAM version and configuration

Technical summary

OpenAM before 16.1.3 does not apply PKCE enforcement to OpenID Connect hybrid flows (code token, code id_token, code token id_token), allowing an attacker to intercept and redeem codes for public client tokens with any non-empty code_verifier, potentially leading to unauthorized access. Defenders should verify OpenAM version and configurations, review OAuth2 and OpenID Connect flows, and monitor for suspicious requests to mitigate this vulnerability. Upgrading to OpenAM version 16.1.3 or later is recommended to ensure proper PKCE enforcement across all OAuth2 and OpenID Connect flows.

Defensive priority

Defenders should prioritize verifying and upgrading to OpenAM version 16.1.3 or later to ensure proper PKCE enforcement across all OAuth2 and OpenID Connect flows.

Recommended defensive actions

• Verify OpenAM version and upgrade to 16.1.3 or later
• Review and update OAuth2 and OpenID Connect flow configurations
• Monitor for suspicious authorization requests and token redemption attempts
• Confirm whether affected OpenAM deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in OpenAM before 16.1.3, where PKCE enforcement is not applied to OpenID Connect hybrid flows, allowing an attacker to redeem intercepted codes for public client tokens.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.