CVE-2026-46498: 
Java vulnerability analysis and mitigation

CVE-2026-46498 is an Authorization Bypass Through User-Controlled Key vulnerability (CWE-639) in OpenAM Community Edition's stateful OAuth2 token-read path, enabling an attacker to forge OAuth2 bearer tokens and OIDC ID tokens with arbitrary subject, client, realm, and scope. It affects OpenAM Community Edition through version 16.0.6 (Maven package org.openidentityplatform.openam:openam-oauth2). The vulnerability was published and patched on June 25, 2026, with the fix available in version 16.1.1. It carries a CVSS v4.0 base score of 7.1 (High) (Github Advisory, OpenAM Advisory).

The root cause (CWE-639) lies in OpenAM's stateful OAuth2 token-read path, which reads caller-supplied token identifiers from the shared Core Token Store (CTS) without placing them in an OAuth-only namespace and without binding the row's trusted CTS type to the expected OAuth token family. As a result, any CTS row whose BLOB claims to be an OAuth token is accepted on the read path with no integrity check. Exploitation requires a low-privileged attacker to first place attacker-controlled JSON into the shared CTS under a known identifier — a primitive achievable via the anonymous Push Notification SNS callback handler in Push Notification-enabled realms after a single legitimate Push registration. The attack is network-based, requires low privileges, and no user interaction (Github Advisory, OpenAM Advisory).

Successful exploitation allows an attacker to forge OAuth2 bearer tokens and OIDC ID tokens with attacker-chosen userName, clientID, realm, and scope, effectively impersonating any user or client within the affected realm. This can lead to unauthorized access to OAuth2-protected resources and APIs, privilege escalation within connected applications, and potential lateral movement across services that trust the forged tokens. Notably, the compromise does not by itself create an OpenAM SSO session or grant admin-console access, but the integrity of the OAuth2 authorization framework is fully undermined (Github Advisory).

1. Reconnaissance: Identify OpenAM Community Edition deployments (version ≤ 16.0.6) with the OAuth2 Provider service and Push Notification service enabled in a realm. This can be done by probing known OpenAM endpoints or reviewing exposed service configurations.
2. Obtain low-privileged access: Register a legitimate Push Notification device using a low-privileged user account in the target realm, which grants access to the anonymous Push Notification SNS callback handler.
3. Inject attacker-controlled JSON into CTS: Use the Push Notification SNS callback handler to write attacker-controlled JSON data into the shared Core Token Store (CTS) under a known or predictable token identifier. Craft the JSON BLOB to mimic the structure of a valid OAuth2 token with desired userName, clientID, realm, and scope fields.
4. Trigger the OAuth2 token-read path: Submit the known CTS identifier as a bearer token to the OAuth2 token introspection or resource endpoint. Because the token-read path performs no namespace isolation or CTS type binding check, it accepts the attacker-crafted CTS row as a valid OAuth2 token.
5. Forge and use the token: The forged OAuth2 bearer token or OIDC ID token — with attacker-chosen identity attributes — is accepted by downstream resource servers, granting unauthorized access to protected resources as the impersonated user or client (Github Advisory, OpenAM Advisory).

• Network: Unexpected or anomalous HTTP requests to the Push Notification SNS callback handler endpoint from low-privileged or unknown user accounts; OAuth2 token introspection requests using token identifiers that do not match expected token issuance patterns.
• Logs: OpenAM access logs showing Push Notification callback invocations followed shortly by OAuth2 token validation requests from the same source IP; token introspection or resource access events for users or clients not expected to have active sessions.
• CTS/Data Store: Presence of unexpected or malformed JSON entries in the Core Token Store (CTS) with token identifiers not corresponding to legitimate OAuth2 token issuance events; CTS rows with OAuth2 token BLOBs lacking expected metadata (e.g., missing issuance timestamps, unusual scope values).
• Application Behavior: OAuth2-protected resources accessed by accounts or clients with scopes or roles inconsistent with their authorization history; OIDC ID tokens presented with subject claims that do not match active SSO sessions.

The vulnerability has been patched in OpenAM Community Edition version 16.1.1, released June 17, 2026. All users running version 16.0.6 or earlier with the OAuth2 Provider service enabled should upgrade to 16.1.1 immediately. As a temporary workaround where upgrading is not immediately possible, consider disabling the Push Notification service in affected realms to remove the CTS write primitive required for exploitation. Restricting network access to the Push Notification SNS callback handler endpoint can also reduce exposure (OpenAM Release, Github Advisory).

The vulnerability was reported by researcher wodzen, who also discovered several other significant vulnerabilities in OpenAM patched in the same 16.1.1 release (including session hijacking, RCE via deserialization, and authentication bypass issues). The OpenAM maintainers (vharseko) published the advisory and patch promptly on the same day. No broader media coverage or notable community commentary beyond the GitHub advisory has been identified at this time (OpenAM Release, OpenAM Advisory).