CVE-2026-123542

MediumCVSS 6.8/10Last modified Nov 10, 2026

Description

OpenAM before 16.1.4 fails to enforce PKCE in the OAuth 2.0 device authorization flow, never validating the code verifier when device codes are exchanged for tokens. Attackers who obtain an approved device code from client logs or shared device storage can redeem it for access and ID tokens to impersonate the user.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-358

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 8, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1235437.5OpenAM before 16.1.4 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sendingCVE-2026-1235446.8OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal server-to-server SOAP channel, allowing netwCVE-2026-1235457.1OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device authorization flow that allows CVE-2026-1235466.1OpenAM before 16.1.4 contains an open redirect and cross-site scripting vulnerability that allows remote attackers to control post-login andCVE-2026-1235474.7OpenAM before 16.1.4 contains an open redirect vulnerability that allows attackers to redirect users to external sites because RelayState isCVE-2026-1235484.7OpenIdentityPlatform OpenAM before 16.1.4 contains an open redirect because WS-Federation logout, SAML v2.0 logout and name-identifier managCVE-2026-1235499.8OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, allowing anonymous attackers to set restrCVE-2026-123558.1IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 throughCVE-2026-1235509.8OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts unsigned assertions on tCVE-2026-12355110.0OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to read live sessionCVE-2026-1235526.5OpenAM before 16.1.4 contains a server-side request forgery vulnerability in certificate CRL checking that fetches CRLs from the distributioCVE-2026-1235536.5OpenAM before 16.1.4 ships built-in identities in the Top Level Realm (demo, anonymous, wsc, wsp, SecurityTokenService and agentAuth) with p
CVE-2026-123542: Medium severity, CVSS 6.8 | Vulnix