CVE-2026-123549: Security vulnerability

Published Nov 8, 2026

Updated

OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, allowing anonymous attackers to set restricted attributes including group membership. Attackers can register through the legacy self-service REST endpoint or User Self-Service flow to join administrative groups and gain full administrative control of OpenAM.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenAM to a version that resolves this vulnerability.
Fixed in 16.1.4

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

OpenAM versions before 16.1.4 are affected where users can self-register through either the legacy self-service REST endpoint or the User Self-Service flow. The described attack is anonymous, so it does not require an existing account.

What does an attacker need to do to gain administrative control?

The attacker must be able to use a self-registration path and submit restricted attributes that include membership in an administrative group. Because the Valid Creation Attributes list is not enforced, they can assign that membership during registration and obtain full administrative control.

Are both self-registration interfaces affected?

Yes. The issue can be exploited through the legacy self-service REST endpoint or through the User Self-Service flow.

CVE-2026-123549: Security vulnerability

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to gain administrative control?

Are both self-registration interfaces affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to gain administrative control?

Are both self-registration interfaces affected?