{"id":"CVE-2026-46560","summary":"OpenAM Authentication Bypass via RADIUS Spoofing","details":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `RADIUS` authentication module opens an unconnected datagram socket and trusts the first UDP datagram received on the client source port. The receive path does not verify the source IP and port, match the response identifier to the outstanding request, or verify the RFC 2865 `Response Authenticator`; the RFC 2869 `Message-Authenticator` is neither sent nor required. Any non-Reject/non-Challenge packet is treated as success. On a deployment with a `RADIUS` module instance enabled on a login chain, an unauthenticated network attacker can race the real server on-path or spray forged `Access-Accept` packets off-path and obtain a session for any `RADIUS`-mapped username without knowing the shared secret. Unlike CVE-2024-3596, exploitation requires no MD5 chosen-prefix forgery because no response authenticator is checked. The resulting session carries the impersonated principal's privileges. This issue is fixed in version 16.1.1.","aliases":["GHSA-386j-6m86-78f9"],"modified":"2026-10-31T13:20:12.255947539Z","published":"2026-10-30T18:36:24.763Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-347"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46560.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46560.json"},{"type":"FIX","url":"https://github.com/OpenIdentityPlatform/OpenAM/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775"},{"type":"WEB","url":"https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1"},{"type":"ADVISORY","url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-386j-6m86-78f9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46560"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openidentityplatform/openam","events":[{"introduced":"0"},{"fixed":"fe2271ec119e827b4252cec20293480322a84789"},{"fixed":"5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775"}],"database_specific":{"extracted_events":[{"strategy":"StringRangeExpression","range":[{"introduced":"0"},{"fixed":"16.1.1"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_TAG","original_tag":"16.1.1","range":[{"fixed":"fe2271ec119e827b4252cec20293480322a84789"}]}]}}],"versions":["16.0.6","16.0.5","16.0.4","16.0.3","15.2.2","15.2.1","15.2.0","15.1.6","15.1.5","15.1.4","15.1.3","15.1.2","15.1.1","15.1.0","15.0.4","15.0.3","15.0.2","15.0.1","15.0.0","14.8.4","14.8.3","14.8.2","14.8.1","14.7.4","14.7.3","14.7.2","14.7.1","14.7.0","14.6.6","14.6.5","14.6.4","14.6.3","14.6.2","14.5.4","14.5.3","14.5.2","14.5.1","14.4.2","14.4.1","14.3.1","14.2.2","14.2.1","14.1.17","14.1.16","14.1.13","14.1.12","14.1.11","14.1.10","14.1.9","14.1.8","14.1.7","14.1.6","14.1.5","14.1.4","14.1.3","14.1.2","14.1.1","14.0.6","14.0.5","14.0.4","14.0.3","14.0.2","14.0.1","14.0.0","13.0.0","13.0.0-RC10","13.0.0-RC9","13.0.0-RC8","13.0.0-RC7","13.0.0-RC6","13.0.0-RC5","13.0.0-RC4","13.0.0-RC3","13.0.0-RC2","13.0.0-RC1"],"database_specific":{"vanir_signatures_modified":"2026-10-31T13:20:12Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46560.json","vanir_signatures":[{"digest":{"function_hash":"251237120994908528631026416952304053783","length":163},"id":"CVE-2026-46560-0928f043","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775","target":{"file":"openam-authentication/openam-auth-radius/src/main/java/com/sun/identity/authentication/modules/radius/client/RadiusConn.java","function":"RadiusConn"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775","target":{"file":"openam-authentication/openam-auth-radius/src/main/java/com/sun/identity/authentication/modules/radius/RADIUS.java","function":"process"},"deprecated":false,"digest":{"function_hash":"315440013065949253901816301387122196614","length":5708},"id":"CVE-2026-46560-16c92dee"},{"signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775","target":{"file":"openam-authentication/openam-auth-radius/src/main/java/com/sun/identity/authentication/modules/radius/client/RadiusConn.java","function":"send"},"deprecated":false,"digest":{"function_hash":"84972319956435951221893659876196463491","length":531},"id":"CVE-2026-46560-1826d943","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"192360785585113485020441215419081278474","length":160},"id":"CVE-2026-46560-294fa85d","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775","target":{"file":"openam-authentication/openam-auth-radius/src/main/java/com/sun/identity/authentication/modules/radius/client/RadiusConn.java","function":"RadiusConn"}},{"signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775","target":{"file":"openam-authentication/openam-auth-radius/src/main/java/com/sun/identity/authentication/modules/radius/client/RadiusConn.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["71586142033044627450385040065707115535","338623533446564925999858103757017294840","325458253999767970688565962511525421844","36585707467160199722361754685082470318","307957436163256398284560049876375508749","1273753730293786291054478224246424185","162159187030399478407746743880107687472","230414195021283019502228259272609315705","251675568761900897333304492036086079454","332173243347309245424000861865702605547","304923557415220894557911544402310612034","319904910560282733558355917377290588423","282452285550427761825809010555401548288","174229307039302799883369858104070218389","325657108983168831134033566039722156596","185618224766035830151144761143319816576","151506646185854322583979048190336090579","141819019222715323180184968848377134216","340160441993501403808374760850862740897","162164033242916573152170805934907998014","240961126943607662259376975403302287128","320055390547934259808678222781107578764","281489763498874081827539569738821796556","331756078453733290016966284267232582211","84135516376829414090600985903503921415","141910812228598010543916196544974511675","192127127789138665521483724650203237741","83482432519205413475265722906417024621","235686627601350612703653275194963701473","82507251441664006998940422962846658692","124757479717626216773150561132522210736","258572067958388974072733459908226096623","87039231161800679506808265838961898106","315135507206368983260339043409875131604","172632474161859568464136510665390175459","259109423987031962491672005905988457822","337678497014578674104993272068030987634","315667738479837340519881149482070206466","181241879239448904347891631513450636875","168768741943604495963050720897949349445","326221310082279861661814219919595837261","155436575040096761903464964552929497918","93596907851292830967003642155816963662","205332677339238575379202785057763570267","59368329814563589739371461002722272447","148550794097976237056043201903428295454","315911783941868711970896474212277902575","109152734672874790267082631558018044053","281099840410619300940642805985223319476","178710204296015650686685062480639226582","256802558253749104357824968875902600216","101899549388559483453900537815484282399","97135194877054744749376132753737826909","232416158445008685598611918378820399428","234190543195650652748511295336555300314","32653126130813239856338852323366198277","198281112323749136560550469006229951997","41771871763597611478476232932157781884","101001884853719323741238751598739611399","130976725892540063120045411117822857839","83582866050722682366249530753595673251","129446691602103381940521990476591552371","319312887734020007414072052487166183550","66119591857539517868342142614660052220","185926246570646504216235813152279793671","225491718499369087950284120959608972604","231293499612866877158253954647075280763","307402223567879079572848975424178576287","299157809005338775715768739955646136080","218900369030130613677605027020664499573","257899220450242441047853197163409082091","156487259784899032144833865105818822390","34603382860227689308377608335416828990","333611518383318162167932802643901024482","279650452234868716581894227299143590930","97603619892706879258848702159813072051","320286018785994392258778824482035368398","181711060876437964299880735050232061552","114240194985819813327716883927678398747","90278503651662296094842237037141353976","172145317422568019590076237566826960344","4111807553134856184280523615889687384","20776399007806634958527448858532954930","165756904658331432729374045596418090514","97135194877054744749376132753737826909","176986907800006272736336941243942187921","198912757285184139965757397664050565896","268267698258134499089481209763858680711","271056682935296333221565769723252948089","49937704052300249968717202827379008642","268802665949476945670521101165971547801","7851865150310207690870964136662286293","18808540065616570449771792039639439084","293060144257239399852338901233378230066","71080375152766150595887234917765532870","263728723448941480176598476368715470182","89905735713861219210615611794136056586","308234454645065096897671340427270027137","315139154777897936625038092828133059191","11708675512528735359475919490329295109","5440055700691027097044214700121273689","108587633537507210242609878158511307392"]},"id":"CVE-2026-46560-2d5709b7","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775","target":{"file":"openam-authentication/openam-auth-radius/src/main/java/com/sun/identity/authentication/modules/radius/client/RadiusConn.java","function":"sendPacket"},"deprecated":false,"digest":{"function_hash":"337169586693606197193278288479672394582","length":1022},"id":"CVE-2026-46560-462323ee"},{"deprecated":false,"digest":{"function_hash":"327749082637802741730466979952573036609","length":2704},"id":"CVE-2026-46560-50c236b1","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775","target":{"file":"openam-radius/openam-radius-common/src/main/java/org/forgerock/openam/radius/common/AttributeFactory.java","function":"createAttribute"}},{"id":"CVE-2026-46560-71c18875","signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775","target":{"file":"openam-radius/openam-radius-common/src/main/java/org/forgerock/openam/radius/common/AttributeSet.java"},"deprecated":false,"digest":{"line_hashes":["56138788554943747616724106122462014481","239168523684862350437498139926096179422","216532935114015461473688800853006973444"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775","target":{"file":"openam-authentication/openam-auth-radius/src/main/java/com/sun/identity/authentication/modules/radius/client/RadiusConn.java","function":"run"},"deprecated":false,"digest":{"function_hash":"10292373518357251307755911992382773274","length":1605},"id":"CVE-2026-46560-77ed4e3e","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775","target":{"file":"openam-authentication/openam-auth-radius/src/main/java/com/sun/identity/authentication/modules/radius/client/RadiusConn.java","function":"disconnect"},"deprecated":false,"digest":{"function_hash":"110153810770379898923573545858031032806","length":65},"id":"CVE-2026-46560-9cc9926a"},{"source":"https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775","target":{"file":"openam-radius/openam-radius-common/src/main/java/org/forgerock/openam/radius/common/AttributeFactory.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["332948839581005097435660454156215631760","211929672977374675987134090160123787207","166023417562933338667384411285583054494","53505067550883821089491587316461031674","221288278349825224645968092954147721080"]},"id":"CVE-2026-46560-a3c0915c","signature_type":"Line","signature_version":"v1"},{"target":{"file":"openam-authentication/openam-auth-radius/src/main/java/com/sun/identity/authentication/modules/radius/RADIUS.java"},"deprecated":false,"digest":{"line_hashes":["204649955623417199666007154341759282641","19636428987238387958149013574734220674","185838351479549880803485264656842923192","204716541900627851870235082165670189254","183576817057949061034871549966774064821","117215259243786710312753843505035675026","272627965917126368218742912167030176968","288043333985949123063865171808687079785","159498708004820102953966973680619344095","277345353882222224888119110947020902228","154230027290254969845310040712763934858","323085596837933930512205662609690723540"],"threshold":0.9},"id":"CVE-2026-46560-a9f5c578","signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775"},{"deprecated":false,"digest":{"line_hashes":["167879494323924328848214120721920597773","331347973398505739998762993618292365806","29657130986881719955706985902743672356","59201517073040126134205956830535729972","90521971688286901917565086517753317606","311423203721786652041109666537256894976","12647774837979104491678561346903457739"],"threshold":0.9},"id":"CVE-2026-46560-e13b5cb6","signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775","target":{"file":"openam-radius/openam-radius-common/src/main/java/org/forgerock/openam/radius/common/PacketFactory.java"}},{"source":"https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775","target":{"function":"toPacket","file":"openam-radius/openam-radius-common/src/main/java/org/forgerock/openam/radius/common/PacketFactory.java"},"deprecated":false,"digest":{"length":175,"function_hash":"205503834128153942531870465261460492886"},"id":"CVE-2026-46560-e6471613","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775","target":{"function":"RadiusConn","file":"openam-authentication/openam-auth-radius/src/main/java/com/sun/identity/authentication/modules/radius/client/RadiusConn.java"},"deprecated":false,"digest":{"function_hash":"47317284111521044153826404787662575869","length":524},"id":"CVE-2026-46560-e851d453"},{"target":{"file":"openam-authentication/openam-auth-radius/src/main/java/com/sun/identity/authentication/modules/radius/client/RadiusConn.java","function":"receive"},"deprecated":false,"digest":{"function_hash":"241371023892555501444050763811510862922","length":365},"id":"CVE-2026-46560-eabd4598","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775"},{"digest":{"threshold":0.9,"line_hashes":["163902533351650869307562520408881200921","119008768319636659299992706557055359353","10258181064199284641030788577283615179","99703002050037390255751066138083617197","180017523590254477462056651424061923440"]},"id":"CVE-2026-46560-ef49b4d6","signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775","target":{"file":"openam-radius/openam-radius-common/src/main/java/org/forgerock/openam/radius/common/AttributeType.java"},"deprecated":false},{"source":"https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775","target":{"function":"init","file":"openam-authentication/openam-auth-radius/src/main/java/com/sun/identity/authentication/modules/radius/RADIUS.java"},"deprecated":false,"digest":{"function_hash":"142231389118063151931290157544346004879","length":2880},"id":"CVE-2026-46560-f3bbadf3","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}