Openam 14.5.1 Before 16.1.4 Csrf In Oauth 2.0 Device Flow

Back www.vulncheck.com

Openam 14.5.1 Before 16.1.4 Csrf In Oauth 2.0 Device Flow

www.vulncheck.com • November 8, 2026

Share: View original

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2026-123545: CSRF Vulnerability in OpenIdentityPlatform's OAuth 2.0 Flow OpenAM versions 14.5.1 to 16.1.3 are affected by a cross-site request forgery (CSRF) vulnerability in the OAuth 2.0 device authorization flow. This flaw allows attackers to approve device codes without user consent, potentially compromising user accounts. Attackers can lure logged-in users to malicious pages, gaining access and ID tokens to call APIs as that user. The vulnerability is particularly concerning for organizations using implied-consent clients that allow consent to be skipped. OpenAM 16.1.4 addresses this issue by requiring explicit user actions for device code approvals. As of now, there is no evidence of active exploitation, but the risk remains high due to the potential for account compromise. Organizations are advised to upgrade to the fixed version and review their configurations to mitigate risks. 1 sources 58

Extracted Entities

CWE Weaknesses (1)

CWE-352 - Cross-Site Request Forgery (csrf)

Platforms (1)

Vulnerabilities (1)

CSRF In OAuth 2.0 Device Flow