{"id":"CVE-2026-46498","summary":"OpenAM Arbitrary OAuth Token Minting via Push Registration","details":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, OAuthTokenStore reads caller-supplied token identifiers from the shared Core Token Store (CTS) without an OAuth-only namespace, and OAuthAdapter accepts a row whose BLOB claims to contain an OAuth token without binding the trusted CTS type or verifying integrity. An attacker who can place controlled JSON in CTS under a known token identifier, such as through Push Registration followed by an anonymous SNS callback in an enabled realm, can mint OAuth bearer tokens and OpenID Connect ID tokens with chosen subject, client, realm, and scope. The flaw does not by itself create an OpenAM SSO session or grant console access. This issue is fixed in version 16.1.1.","aliases":["GHSA-cj8f-2fhf-826r"],"modified":"2026-09-17T08:08:34.686135Z","published":"2026-09-15T09:50:24.721Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-639"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46498.json"},"references":[{"type":"WEB","url":"https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46498.json"},{"type":"ADVISORY","url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-cj8f-2fhf-826r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46498"},{"type":"FIX","url":"https://github.com/OpenIdentityPlatform/OpenAM/commit/e047b01f24ce5006dbd62b3084b17df2d7835763"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openidentityplatform/openam","events":[{"introduced":"0"},{"fixed":"e047b01f24ce5006dbd62b3084b17df2d7835763"},{"fixed":"fe2271ec119e827b4252cec20293480322a84789"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"16.1.1"}]}}],"versions":["16.0.6","16.0.5","16.0.4","16.0.3","15.2.2","15.2.1","15.2.0","15.1.6","15.1.5","15.1.4","15.1.3","15.1.2","15.1.1","15.1.0","15.0.4","15.0.3","15.0.2","15.0.1","15.0.0","14.8.4","14.8.3","14.8.2","14.8.1","14.7.4","14.7.3","14.7.2","14.7.1","14.7.0","14.6.6","14.6.5","14.6.4","14.6.3","14.6.2","14.5.4","14.5.3","14.5.2","14.5.1","14.4.2","14.4.1","14.3.1","14.2.2","14.2.1","14.1.17","14.1.16","14.1.13","14.1.12","14.1.11","14.1.10","14.1.9","14.1.8","14.1.7","14.1.6","14.1.5","14.1.4","14.1.3","14.1.2","14.1.1","14.0.6","14.0.5","14.0.4","14.0.3","14.0.2","14.0.1","14.0.0","13.0.0","13.0.0-RC10","13.0.0-RC9","13.0.0-RC8","13.0.0-RC7","13.0.0-RC6","13.0.0-RC5","13.0.0-RC4","13.0.0-RC3","13.0.0-RC2","13.0.0-RC1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46498.json","vanir_signatures_modified":"2026-09-17T08:08:34Z","vanir_signatures":[{"target":{"file":"openam-core/src/main/java/org/forgerock/openam/cts/adapters/OAuthAdapter.java"},"deprecated":false,"digest":{"line_hashes":["4402402801655424047735895083664777177","279820692193834582913164217675945148388","31027551089024896088451104836152794077","312239353790893788237886663410928160457","262989714831267116015422427532740370915","93190714852686444598205288010855756668","40345314243955709006860401541284289813","289170317131184721091636361471065531367","128573703978371016777149325678804468793"],"threshold":0.9},"id":"CVE-2026-46498-1c682e90","signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/e047b01f24ce5006dbd62b3084b17df2d7835763"},{"target":{"file":"openam-oauth2/src/main/java/org/forgerock/openam/oauth2/OAuthTokenStore.java"},"deprecated":false,"digest":{"line_hashes":["54370802366907490269728711920823079719","34218095166225379068316758795987866822","188105458601082137638558825630009173887","201483049575917215899839197940637989776","253865711142032991491931072409696101916","60283545972431363834043985494638163978","240456643636485891524167666229748506113","270103876652369688210178203192426638326","206522996538973784350779693772886138794","146767560028738975388935350519277847258","312646297934930901419233010414964584543","246533559630584760974832604162422964500","151239051768229572885857115690274157624","229372982145645993935544966628781823494","312241271355781285423697379855466019912","178748109378741947983175619096099139242","279118738397569944925485559297762383710","59808444799047796316677886989330740438","297150441010957537578719923826603884179","205174811896851109971588761469231393153","82217527904429932269604569199738099653","71238721469563630543703970723142292104","16101614206532741891974100168446118262","210506171439103346466202092363848931181","308043182455678797464324811772628282169","180524035180744809388633476667677037399","151478495357773284090506078900559840788","20849665838306607464431807720067802707","25677794487250599804020485036316249147","86083717693730204871408247564839657111","334374078194713750774879770367444599933","159040089670309004312031623028352442205","313406610992382712952301686387809917033","190720181761838101885315264521551729144","54341376107089451873635561267781868237","331295121511053514823956235636309374691","5018370269090582097047947695931013833"],"threshold":0.9},"id":"CVE-2026-46498-324fcb12","signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/e047b01f24ce5006dbd62b3084b17df2d7835763"},{"id":"CVE-2026-46498-4848040b","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/e047b01f24ce5006dbd62b3084b17df2d7835763","target":{"file":"openam-oauth2/src/main/java/org/forgerock/openam/oauth2/OAuthTokenStore.java","function":"query"},"deprecated":false,"digest":{"function_hash":"125892342810460629813616474629214354651","length":178}},{"deprecated":false,"digest":{"function_hash":"44985955183705510500559140037835780671","length":169},"id":"CVE-2026-46498-527b9340","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/e047b01f24ce5006dbd62b3084b17df2d7835763","target":{"file":"openam-oauth2/src/main/java/org/forgerock/openam/oauth2/OAuthTokenStore.java","function":"convertResults"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/e047b01f24ce5006dbd62b3084b17df2d7835763","target":{"file":"openam-core/src/test/java/org/forgerock/openam/cts/adapters/OAuthAdapterTest.java"},"deprecated":false,"digest":{"line_hashes":["306920274984925882893435576559643926337","120293199181644680792049763113480367385","228728392692486891708094962681437371670","1648923463691342314944018979451066068","202776781096290471572271888730880094175","181414440235026342908288788143725010963","293464418737750550198981941676083444425"],"threshold":0.9},"id":"CVE-2026-46498-6aee71bc"},{"digest":{"line_hashes":["106398072025165087082950528430172641983","164404483901464536816409333696216502723","223253860994522350390854525614431258651","296094699269368986513647123769170069577","164981796970061039069481387054632867012","95061397954490746664961511848369591059","206453119519929778296508010248870749966","113698104483769733820139736362513183224","250237654724815185325084278405702827581","336865816055040381770014044889705553002","273934369727699864804597136125840823653"],"threshold":0.9},"id":"CVE-2026-46498-74226f4b","signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/e047b01f24ce5006dbd62b3084b17df2d7835763","target":{"file":"openam-core/src/test/java/org/forgerock/openam/cts/api/tokens/TokenIdFactoryTest.java"},"deprecated":false},{"target":{"function":"delete","file":"openam-oauth2/src/main/java/org/forgerock/openam/oauth2/OAuthTokenStore.java"},"deprecated":false,"digest":{"function_hash":"63397587131780904985192350666933201627","length":497},"id":"CVE-2026-46498-d5644b32","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/e047b01f24ce5006dbd62b3084b17df2d7835763"},{"id":"CVE-2026-46498-e5d668e7","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/e047b01f24ce5006dbd62b3084b17df2d7835763","target":{"file":"openam-core/src/main/java/org/forgerock/openam/cts/adapters/OAuthAdapter.java","function":"fromToken"},"deprecated":false,"digest":{"function_hash":"248519308020964765317254198145159075910","length":311}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/e047b01f24ce5006dbd62b3084b17df2d7835763","target":{"file":"openam-core/src/main/java/org/forgerock/openam/cts/api/tokens/TokenIdFactory.java"},"deprecated":false,"digest":{"line_hashes":["147494789986948597192070952531027727705","229243015590495179412098402153546908780","299678746475038913939161481148360350624","25942611736219006784223645916759674480"],"threshold":0.9},"id":"CVE-2026-46498-ed6aa6ca"},{"id":"CVE-2026-46498-f50d4e1b","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/e047b01f24ce5006dbd62b3084b17df2d7835763","target":{"file":"openam-core/src/main/java/org/forgerock/openam/cts/adapters/OAuthAdapter.java","function":"toToken"},"deprecated":false,"digest":{"function_hash":"150023854442248278829098210578282054269","length":1342}},{"deprecated":false,"digest":{"function_hash":"285175328290823655954312010605143034624","length":207},"id":"CVE-2026-46498-f78280bc","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/e047b01f24ce5006dbd62b3084b17df2d7835763","target":{"file":"openam-oauth2/src/main/java/org/forgerock/openam/oauth2/OAuthTokenStore.java","function":"read"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}