PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-48717 OpenIdentityPlatform CVE debrief

Open Access Management (OpenAM) has a critical vulnerability prior to version 16.1.1. The AuthorizationCodeGrantTypeHandler requires a code_verifier only when the realm-wide codeVerifierEnforced setting is enabled. However, even when an authorization code stores a code_challenge, the code_verifier is not always required due to the default disabled setting. This allows an attacker who intercepts a PKCE-protected authorization code to redeem the code without a code_verifier. Public clients are directly affected, and confidential-client exploitation requires additional authentication material or context.

Vendor
OpenIdentityPlatform
Product
OpenAM
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-15
Original CVE updated
2026-09-23
Advisory published
2026-09-15
Advisory updated
2026-09-23

Who should care

Defenders responsible for OpenAM deployments should assess exposure and upgrade to version 16.1.1 if vulnerable. Security teams monitoring for suspicious authorization code redemption attempts should also be aware of this vulnerability.

Why it matters

CVE-2026-48717 is a critical vulnerability in Open Access Management (OpenAM) that allows an attacker to redeem an intercepted PKCE-protected authorization code without a code_verifier. Defenders must assess exposure, upgrade to version 16.1.1 if vulnerable, and monitor for suspicious activity.

  • Defenders must verify OpenAM version and configurations to determine exposure.
  • Immediate upgrade to version 16.1.1 is required for vulnerable deployments.
  • Monitoring for suspicious authorization code redemption attempts is necessary.
  • Reviewing authorization code redemption processes for potential vulnerabilities is essential.

Technical summary

The AuthorizationCodeGrantTypeHandler in Open Access Management (OpenAM) prior to version 16.1.1 does not require a code_verifier for authorization code redemption when the realm-wide codeVerifierEnforced setting is disabled by default. This allows an attacker to redeem an intercepted PKCE-protected authorization code without a code_verifier. Public clients are directly affected, and confidential-client exploitation requires client authentication material or another redemption context.

Defensive priority

Immediately assess exposure and upgrade to version 16.1.1 if vulnerable.

Recommended defensive actions

  • Assess exposure by checking current OpenAM version and configurations.
  • Upgrade to version 16.1.1 or later.
  • Review authorization code redemption processes for potential vulnerabilities.
  • Monitor for suspicious authorization code redemption attempts.
  • Verify OpenAM deployments for codeVerifierEnforced setting.
  • Review compensating controls for exposed systems.
  • Track exceptions and retest remediated assets.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and its impact. However, additional information on affected deployments and exploitation attempts is limited. Defenders should verify OpenAM version and configurations to determine exposure, review authorization code redemption processes for potential vulnerabilities, and monitor for suspicious activity. Limited source detail exists on actual exploitation or affected scope beyond OpenAM versions prior to 16.1.1.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-48717 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-48717

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-48717 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-48717

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.