CVE Alert: CVE-2026-123545 – OpenIdentityPlatform

OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device authorization flow that allows attackers to approve device codes when consent is skipped for implied-consent clients. Attackers can start a device authorization and lure a logged-in user to a crafted page, obtaining access and ID tokens to call APIs as that user.

**Risk verdict:** High-impact account compromise is plausible, but the supplied data does not establish active exploitation or support an emergency-priority designation.

**Why this matters:** A successful attack could expose sensitive user data and permit limited actions through APIs available to the victim. The attacker’s likely goal is to obtain usable tokens without credentials, then exploit the victim’s existing access; business impact depends on the permissions attached to those accounts.

**Most likely attack path:** The attacker can reach the service over a network without prior privileges or special attack conditions, but must induce a logged-in user to interact with attacker-controlled content. The assessed scope is unchanged, so direct impact is bounded to the affected service and the victim’s permissions; API access may nevertheless expose connected business data.

**Who is most exposed:** Organisations using this identity and access management platform for OAuth device authorisation are most exposed, particularly where implied-consent clients are enabled and the service is internet-accessible.

Alert on device authorisations approved without an expected consent step.

Correlate device-code creation, approval and token issuance by account, IP and timing.

Review tokens issued through the device flow for unusual API access or data volume.

Investigate user reports of unexpected approval prompts or unfamiliar sessions.

Mitigation and prioritisation:

Upgrade to the vendor’s fixed release; prioritise externally reachable deployments.

Until patched, disable or restrict affected device-flow and implied-consent configurations where feasible.

Require reauthentication or explicit consent for device approvals; limit client scopes and token lifetimes.

Review logs for suspicious approvals and revoke potentially exposed tokens.

Confirm KEV, SSVC, PoC and EPSS status before final urgency ranking; these signals were not supplied. Apply the fix through tested change control.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.