{"id":"CVE-2025-64099","summary":"OpenAM allows use of arbitrary OIDC requested claims values in id_token and user_info","details":"Open Access Management (OpenAM) is an access management solution. In versions prior to 16.0.0, if the \"claims_parameter_supported\" parameter is activated, it is possible, thanks to the \"oidc-claims-extension.groovy\" script, to inject the value of one's choice into a claim contained in the id_token or in the user_info. In the request of an authorize function, a claims parameter containing a JSON file can be injected. This JSON file allows attackers to customize the claims returned by the \"id_token\" and \"user_info\" files. This allows for a very wide range of vulnerabilities depending on how clients use claims. For example, if some clients rely on an email field to identify a user, an attacker can choose the email address they want, and therefore assume any identity they choose. Version 16.0.0 fixes the issue.","aliases":["GHSA-39hr-239p-fhqc"],"modified":"2026-03-13T03:40:56.951027Z","published":"2025-11-12T18:57:34.036Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64099.json","cwe_ids":["CWE-74"],"cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64099.json"},{"type":"ADVISORY","url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-39hr-239p-fhqc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64099"}],"affected":[{"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-64099.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U"}]}