A critical privilege management flaw in OpenAM before 16.1.4 lets unauthenticated attackers give themselves administrative group membership through self-registration, which leads to full control of the OpenAM instance.
What Is It
CVE-2026-123549 is an improper privilege management weakness (CWE-269) in OpenIdentityPlatform's OpenAM. During self-registration, OpenAM does not enforce its Valid Creation Attributes list. That list is supposed to limit which attributes a new user can set. Because the check is missing, an anonymous attacker can set restricted attributes, including group membership.
According to the NVD description, attackers can exploit this through two paths:
- The legacy self-service REST endpoint
- The User Self-Service flow
Either path lets an attacker register an account that is already a member of administrative groups, which gives them full administrative control of OpenAM.
Why It Matters
OpenAM is an identity and access management platform, so an administrative compromise can affect every application that relies on it for authentication. The CVSS scores show how easy this is to exploit:
- CVSS 3.1: 9.8 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). It is exploitable over the network with low complexity and needs no privileges or user interaction. Impact on confidentiality, integrity and availability is high. - CVSS 4.0: 9.3 CRITICAL (secondary score from VulnCheck).
Exploitation status: None of the sources cited below reports a CISA Known Exploited Vulnerabilities (KEV) listing or confirmed active exploitation, and the CVSS 4.0 exploit maturity is "Not Defined." Check the CISA KEV catalog directly for current status.
What's Vulnerable
- Vendor: OpenIdentityPlatform
- Product: OpenAM
- Package:
pkg:maven/org.openidentityplatform.openam/openam-core-rest - Affected: all versions before 16.1.4
- Unaffected: 16.1.4
VulnCheck disclosed the CVE, and NVD has published a record for it. The NVD record is currently in "Received" status, so NVD has not yet analyzed it.
Patch Status
A fixed release is available. Upgrade OpenAM to 16.1.4, the first version the advisory data lists as unaffected. None of the cited sources gives a CISA KEV remediation deadline. Even so, an unauthenticated route to admin access on an identity platform is a strong reason to patch quickly. This is especially true where self-registration is exposed to untrusted networks.