{"id":"CVE-2026-45052","summary":"OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints","details":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the Liberty Web Services SOAP receiver permits unauthenticated remote requests to write persistent entries through SOAPReceiver and DiscoveryService into a user's Liberty Discovery store and the shared root-realm Discovery branch. The server-side handlers bypass requester LDAP and identity ACLs, and the global path uses an internal administrative token. Deployments that consume Liberty discovery data can subsequently use manipulated service-routing or security-mechanism records. This issue is fixed in version 16.1.1.","aliases":["GHSA-p462-xxwx-pqf4"],"modified":"2026-09-17T08:08:37.043108Z","published":"2026-09-15T09:43:59.219Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45052.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-285"]},"references":[{"type":"WEB","url":"https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45052.json"},{"type":"ADVISORY","url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-p462-xxwx-pqf4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45052"},{"type":"FIX","url":"https://github.com/OpenIdentityPlatform/OpenAM/commit/07e402c3f6321fbe5ffdb213f3817f09a8fc81de"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openidentityplatform/openam","events":[{"introduced":"0"},{"fixed":"07e402c3f6321fbe5ffdb213f3817f09a8fc81de"},{"fixed":"fe2271ec119e827b4252cec20293480322a84789"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"16.1.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["16.0.6","16.0.5","16.0.4","16.0.3","15.2.2","15.2.1","15.2.0","15.1.6","15.1.5","15.1.4","15.1.3","15.1.2","15.1.1","15.1.0","15.0.4","15.0.3","15.0.2","15.0.1","15.0.0","14.8.4","14.8.3","14.8.2","14.8.1","14.7.4","14.7.3","14.7.2","14.7.1","14.7.0","14.6.6","14.6.5","14.6.4","14.6.3","14.6.2","14.5.4","14.5.3","14.5.2","14.5.1","14.4.2","14.4.1","14.3.1","14.2.2","14.2.1","14.1.17","14.1.16","14.1.13","14.1.12","14.1.11","14.1.10","14.1.9","14.1.8","14.1.7","14.1.6","14.1.5","14.1.4","14.1.3","14.1.2","14.1.1","14.0.6","14.0.5","14.0.4","14.0.3","14.0.2","14.0.1","14.0.0","13.0.0","13.0.0-RC10","13.0.0-RC9","13.0.0-RC8","13.0.0-RC7","13.0.0-RC6","13.0.0-RC5","13.0.0-RC4","13.0.0-RC3","13.0.0-RC2","13.0.0-RC1"],"database_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"279508758948928902363447239809148230824","length":544},"id":"CVE-2026-45052-0cc05aaa","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/07e402c3f6321fbe5ffdb213f3817f09a8fc81de","target":{"file":"openam-federation/openam-federation-library/src/main/java/com/sun/identity/liberty/ws/soapbinding/SOAPReceiver.java","function":"doPost"}},{"id":"CVE-2026-45052-31a6608b","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/07e402c3f6321fbe5ffdb213f3817f09a8fc81de","target":{"file":"openam-federation/openam-federation-library/src/main/java/com/sun/identity/liberty/ws/soapbinding/SOAPReceiver.java","function":"onMessage"},"deprecated":false,"digest":{"function_hash":"55422686768470920420563815171119585579","length":3505}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/07e402c3f6321fbe5ffdb213f3817f09a8fc81de","target":{"file":"openam-federation/OpenFM/src/main/java/com/sun/identity/liberty/ws/soapbinding/WebServiceAuthenticatorImpl.java"},"deprecated":false,"digest":{"line_hashes":["155915310750086298742132092186626033334","206960748124756186975818118122563986665","57292376308444264796788718323679168436","6119375716842993562033594380685791281","174655481550099655492894398720446795959","2543068782215361508457697028518570155","166891392289405342556047181612830909971","98447803072030010660593487690787525468","303658030464293852880688834301273266393"],"threshold":0.9},"id":"CVE-2026-45052-507804d0"},{"source":"https://github.com/openidentityplatform/openam/commit/07e402c3f6321fbe5ffdb213f3817f09a8fc81de","target":{"file":"openam-federation/openam-federation-library/src/main/java/com/sun/identity/liberty/ws/security/LibSecurityTokenProvider.java","function":"getSAMLToken"},"deprecated":false,"digest":{"function_hash":"112848720096428742553340095755317226202","length":1805},"id":"CVE-2026-45052-52eadc29","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["63562770948796605757050654074607662814","86324441055241227337359762175028316480","268600362888538297046757740422549076931","316125797977249741236233082372709326011"],"threshold":0.9},"id":"CVE-2026-45052-58ca9dfd","signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/07e402c3f6321fbe5ffdb213f3817f09a8fc81de","target":{"file":"openam-federation/openam-federation-library/src/main/java/com/sun/identity/liberty/ws/idpp/PersonalProfile.java"}},{"signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/07e402c3f6321fbe5ffdb213f3817f09a8fc81de","target":{"file":"openam-federation/openam-federation-library/src/main/java/com/sun/identity/liberty/ws/idpp/PersonalProfile.java","function":"getAuthZAction"},"deprecated":false,"digest":{"function_hash":"74772867305926842738183826247620457214","length":938},"id":"CVE-2026-45052-5ed889d9","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/07e402c3f6321fbe5ffdb213f3817f09a8fc81de","target":{"file":"openam-federation/openam-federation-library/src/main/java/com/sun/identity/liberty/ws/interaction/WSPRedirectHandlerServlet.java"},"deprecated":false,"digest":{"line_hashes":["134247667316210560034385872480173959659","163389377484047192339607821024031221021","176803482657545506139716292610252319251","47945707547971622730390817051322725705"],"threshold":0.9},"id":"CVE-2026-45052-6489e467","signature_type":"Line"},{"target":{"file":"openam-federation/openam-federation-library/src/main/java/com/sun/identity/liberty/ws/disco/common/DiscoUtils.java","function":"generateCredential"},"deprecated":false,"digest":{"function_hash":"182600557255794179539469674289951558221","length":3650},"id":"CVE-2026-45052-7492cfb7","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/07e402c3f6321fbe5ffdb213f3817f09a8fc81de"},{"deprecated":false,"digest":{"line_hashes":["110199845223846394957717471135869362294","295653688541441674694296903296154477861","310966700772198637659547908466365925468","57191312142440298663581637124597023436","61576486527776616661999657715363934831","57074633912648473306908842527147057855","325770334164888778370774820004916462851","224022575203639744167961043909861470957","16046166932779456514353113770009170483","322094513087564367140299132247862570153","38215857796180748943906181630248788022","126330958260855261337163215021756230219","33368911349184907325277799307478291241","135795103345950500537430173611171781687","218926350135394587294197304926295418271"],"threshold":0.9},"id":"CVE-2026-45052-8b54503e","signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/07e402c3f6321fbe5ffdb213f3817f09a8fc81de","target":{"file":"openam-federation/openam-federation-library/src/main/java/com/sun/identity/liberty/ws/soapbinding/SOAPReceiver.java"}},{"deprecated":false,"digest":{"line_hashes":["119733170421881629163847157267062945330","47165741322234308823845794039727664480","310994293127462873664976018944789063306","280014873334325229405860283458695567903"],"threshold":0.9},"id":"CVE-2026-45052-8b8ab78e","signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/07e402c3f6321fbe5ffdb213f3817f09a8fc81de","target":{"file":"openam-federation/openam-federation-library/src/main/java/com/sun/identity/liberty/ws/disco/DiscoveryService.java"}},{"deprecated":false,"digest":{"line_hashes":["204114923429696139911359829110202117543","167199167998200107863266045686833818588","188823726740044027254497844438356663304","102786831435445049307488823599319957814","201388928441967132169340754481754147312","315101268409766455281220316218143688059","22762314296890065668350606109112724639","143437305902212931932041776342249673458","230274493872990002011774653234623623103","13453520278432182273292880399806038864","36632312035965705175584325499056288007","38940205760128108731507366370930728829","185706715167016231451005811550350991440","30977431585294682866643585686219881734","335334568187337238101187082829352243070","201388928441967132169340754481754147312","315101268409766455281220316218143688059","22762314296890065668350606109112724639","143437305902212931932041776342249673458","230274493872990002011774653234623623103","217068293424354475505793555900570422275","316671138545512060344913406475718816255","142498317200594136115048180773811266676"],"threshold":0.9},"id":"CVE-2026-45052-8fa9785d","signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/07e402c3f6321fbe5ffdb213f3817f09a8fc81de","target":{"file":"openam-federation/openam-federation-library/src/main/java/com/sun/identity/liberty/ws/disco/common/DiscoUtils.java"}},{"id":"CVE-2026-45052-d38d4eaa","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/07e402c3f6321fbe5ffdb213f3817f09a8fc81de","target":{"file":"openam-federation/openam-federation-library/src/main/java/com/sun/identity/liberty/ws/disco/DiscoveryService.java","function":"processRequest"},"deprecated":false,"digest":{"function_hash":"82613270006188923956686718872632369682","length":3082}},{"target":{"file":"openam-federation/openam-federation-library/src/main/java/com/sun/identity/liberty/ws/interaction/WSPRedirectHandlerServlet.java","function":"handleRequest"},"deprecated":false,"digest":{"function_hash":"146604213509097314929871809246449398356","length":4466},"id":"CVE-2026-45052-e3b32625","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/07e402c3f6321fbe5ffdb213f3817f09a8fc81de"},{"deprecated":false,"digest":{"function_hash":"101559556076907914583667100319356867236","length":3400},"id":"CVE-2026-45052-f655fdda","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/07e402c3f6321fbe5ffdb213f3817f09a8fc81de","target":{"function":"authenticate","file":"openam-federation/OpenFM/src/main/java/com/sun/identity/liberty/ws/soapbinding/WebServiceAuthenticatorImpl.java"}},{"id":"CVE-2026-45052-fd025526","signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/07e402c3f6321fbe5ffdb213f3817f09a8fc81de","target":{"file":"openam-federation/openam-federation-library/src/main/java/com/sun/identity/liberty/ws/security/LibSecurityTokenProvider.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["4088755731155084774070165432398248551","39548094010206886238851446239019569117","39906473172727925656664072046305152318","144031387905104135830269537861718316574"]}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45052.json","vanir_signatures_modified":"2026-09-17T08:08:37Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:L/SA:N"}]}