CVE-2026-105119: OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows
OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose responsetype is exactly code, so codes issued through OpenID Connect hybrid flows (code token, code idtoken, code token idtoken) carry no bound challenge. An attacker who intercepts such a code can redeem it for a public client's tokens with any non-empty codeverifier.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running OpenAM before 16.1.3 are exposed when they issue authorization codes to public OAuth 2.0 clients through OpenID Connect hybrid response types: code token, code id_token, or code token id_token.
What must an attacker do to exploit this issue?
The attacker must intercept an authorization code issued through an affected hybrid flow. They can then redeem that code for the public client's tokens using any non-empty code_verifier.
How can I determine whether my environment is affected?
Check whether the OpenAM version is earlier than 16.1.3 and whether clients use the affected OpenID Connect hybrid response types. PKCE enforcement applied only when response_type was exactly code, so hybrid-flow codes did not have a bound challenge.