GHSA-545c-rm35-2jj2: OpenAM 14.5.1 before 16.1.4 CSRF in OAuth 2.0 Device Flow

Published Nov 8, 2026

Updated

OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device authorization flow that allows attackers to approve device codes when consent is skipped for implied-consent clients. Attackers can start a device authorization and lure a logged-in user to a crafted page, obtaining access and ID tokens to call APIs as that user.

Event History

Nov 8, 2026

CVE Published

via OSV·01:37 AM

Data Sourced

via OSV·01:37 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

OpenAM versions from 14.5.1 up to, but not including, 16.1.4 are affected when OAuth 2.0 Device Flow is used with implied-consent clients that skip consent.

What does an attacker need to exploit it?

An attacker needs to initiate a device authorization flow and lure a user who is already logged in to OpenAM to a crafted page. The attack relies on the target client skipping consent through implied consent.

What can an attacker obtain through successful exploitation?

An attacker can cause approval of device codes and obtain access tokens and ID tokens. Those tokens can be used to call APIs as the logged-in user.

GHSA-545c-rm35-2jj2: OpenAM 14.5.1 before 16.1.4 CSRF in OAuth 2.0 Device Flow

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What can an attacker obtain through successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What can an attacker obtain through successful exploitation?