CVE-2025-64099: OpenAM allows use of arbitrary OIDC requested claims values in id_token and user_info
Summary If the "claimsparametersupported" parameter is activated, it is possible through the "oidc-claims-extension.groovy" script, to inject the value of choice into a claim contained in the idtoken or in the userinfo. Authorization function requests do not prevent a claims parameter containing a JSON file to be injected. This JSON file allows users to customize claims returned by the "idtoken" and "userinfo" files. This allows for a very wide range of vulnerabilities depending on how clients use claims. For example, if some clients rely on an email field to identify a user, users can choose to entera any email address, and therefore assume any chosen identity.
Other sources
Open Access Management (OpenAM) is an access management solution. In versions prior to 16.0.0, if the "claimsparametersupported" parameter is activated, it is possible, thanks to the "oidc-claims-extension.groovy" script, to inject the value of one's choice into a claim contained in the idtoken or in the userinfo. In the request of an authorize function, a claims parameter containing a JSON file can be injected. This JSON file allows attackers to customize the claims returned by the "idtoken" and "userinfo" files. This allows for a very wide range of vulnerabilities depending on how clients use claims. For example, if some clients rely on an email field to identify a user, an attacker can choose the email address they want, and therefore assume any identity they choose. Version 16.0.0 fixes the issue.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64099?
The severity of CVE-2025-64099 is classified as high due to potential unauthorized access and claims manipulation.
How do I fix CVE-2025-64099?
To fix CVE-2025-64099, upgrade to ForgeRock OpenAM version 16.0.0 or later.
What versions of ForgeRock OpenAM are affected by CVE-2025-64099?
ForgeRock OpenAM versions prior to 16.0.0 are affected by CVE-2025-64099.
What specific feature must be activated to exploit CVE-2025-64099?
The "claims_parameter_supported" parameter must be activated to exploit CVE-2025-64099.
Can CVE-2025-64099 allow for arbitrary injection of claims?
Yes, CVE-2025-64099 allows for arbitrary injection of claim values if exploited.