CVE-2026-47426 OpenIdentityPlatform CVE debrief

Who should care

Defenders managing OpenAM instances, especially those with dynamic client registration enabled, should assess exposure and prioritize upgrading to version 16.1.1. Operators of OpenAM platforms, vulnerability management teams, and security teams should review the vulnerability and plan for remediation. Security teams should also monitor for suspicious authentication activity and review compensating controls for exposed systems.

Why it matters

CVE-2026-47426 allows attackers to bypass authentication in OpenAM, potentially leading to unauthorized access and token minting. Defenders should verify exposure and prioritize remediation.

• Authentication bypass allows unauthorized access to protected resources
• Attackers can mint tokens in the name of another client
• Exposure requires verification for OpenAM instances with dynamic client registration

Technical summary

The private_key_jwt client authentication path in OpenAM uses ClientJwksResolverCache without reliably binding a cached jwks_uri resolver and verified assertion to the expected clientID in ClientCredentialsReader. This allows an attacker controlling any registered client with published keys to authenticate as another client and mint tokens in that client's name across realms in the same OpenAM process. The issue is fixed in version 16.1.1. Defenders should prioritize verifying exposure of OpenAM instances to untrusted clients.

Defensive priority

Defenders should prioritize verifying exposure of OpenAM instances to untrusted clients and upgrading to version 16.1.1.

Recommended defensive actions

• Verify OpenAM instance exposure to untrusted clients
• Upgrade to OpenAM version 16.1.1
• Monitor for suspicious authentication activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but its scope and remediation require verification from official sources. The issue is fixed in version 16.1.1. Defenders should verify exposure and prioritize remediation. OpenAM instances with dynamic client registration enabled are particularly vulnerable. Official CVE Program and NVD records offer source-provided metadata and vulnerability assessments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.