Skip to content
CVE-2026-123545: CSRF Vulnerability in OpenIdentityPlatform's OAuth 2.0 Flow

CVE-2026-123545: CSRF Vulnerability in OpenIdentityPlatform's OAuth 2.0 Flow

First seen 8 Nov 2026, 13:20 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 8, 2026 at 13:21 UTC
  • •CVE-2026-123545 affects OpenAM versions 14.5.1 to 16.1.3.
  • •Attackers can exploit this CSRF vulnerability to obtain user tokens without consent.
  • •Upgrade to OpenAM 16.1.4 is necessary to mitigate this risk.

OpenAM versions 14.5.1 to 16.1.3 are affected by a cross-site request forgery (CSRF) vulnerability in the OAuth 2.0 device authorization flow. This flaw allows attackers to approve device codes without user consent, potentially compromising user accounts. Attackers can lure logged-in users to malicious pages, gaining access and ID tokens to call APIs as that user. The vulnerability is particularly concerning for organizations using implied-consent clients that allow consent to be skipped. OpenAM 16.1.4 addresses this issue by requiring explicit user actions for device code approvals. As of now, there is no evidence of active exploitation, but the risk remains high due to the potential for account compromise. Organizations are advised to upgrade to the fixed version and review their configurations to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 2h ago How this analysis works

Timeline

2026-11-08
CVE-2026-123545 published
OpenAM disclosed a CSRF vulnerability affecting OAuth 2.0 device authorization flow, allowing token approval without user consent.
Redpacketsecurity
2026-11-08
Patch released
OpenAM 16.1.4 was released to fix the CSRF vulnerability by requiring user actions for device code approvals.
github.com

More articles in this cluster (3)

Following this threat?

Track CVE-2026-123545 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 3

Common questions

Which versions of OpenAM are affected?
OpenAM versions from 14.5.1 up to and including 16.1.3 are affected by this CSRF vulnerability.
What should organizations do to protect themselves?
Organizations should upgrade to OpenAM 16.1.4 and review their OAuth configurations to ensure user consent is required.
Is there any evidence of active exploitation?
Currently, there is no evidence of active exploitation of this vulnerability in the wild.