GHSA-jv8f-m88g-h6mm: OpenAM before 16.1.4 Privilege Escalation via Self-Registration Attribute Bypass

Published Nov 8, 2026

Updated

OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, allowing anonymous attackers to set restricted attributes including group membership. Attackers can register through the legacy self-service REST endpoint or User Self-Service flow to join administrative groups and gain full administrative control of OpenAM.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenAM to a version that resolves this vulnerability.
Fixed in 16.1.4

Event History

Nov 8, 2026

CVE Published

via OSV·01:37 AM

Data Sourced

via OSV·01:37 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Anonymous attackers can exploit it if self-registration is available through the legacy self-service REST endpoint or the User Self-Service flow. No existing account is required.

What access can an attacker gain?

An attacker can set restricted attributes during registration, including group membership. By joining administrative groups, they can obtain full administrative control of OpenAM.

Which configurations are affected?

Deployments that permit self-registration through the legacy self-service REST endpoint or User Self-Service flow are exposed because the Valid Creation Attributes list is not enforced. The provided information does not state whether either registration path is enabled by default.

How can administrators determine whether they may be affected?

Check whether the OpenAM deployment is earlier than 16.1.4 and whether anonymous users can self-register through either the legacy REST endpoint or User Self-Service flow. Also review whether restricted attributes, particularly group membership, could be supplied during registration.

GHSA-jv8f-m88g-h6mm: OpenAM before 16.1.4 Privilege Escalation via Self-Registration Attribute Bypass

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What access can an attacker gain?

Which configurations are affected?

How can administrators determine whether they may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access can an attacker gain?

Which configurations are affected?

How can administrators determine whether they may be affected?