CVE-2026-46560: 
Java vulnerability analysis and mitigation

CVE-2026-46560 is an authentication bypass vulnerability in OpenAM's RADIUS authentication module, classified as Improper Verification of Cryptographic Signature (CWE-347). It allows an unauthenticated network-adjacent attacker to spoof a RADIUS Access-Accept response and obtain a valid OpenAM session for any RADIUS username without knowing the configured shared secret. The vulnerability affects OpenAM Community Edition through version 16.0.6 (Maven package org.openidentityplatform.openam:openam-radius) and was patched in version 16.1.1. It was published and patched on June 25, 2026, with a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, OpenAM Advisory).

The root cause (CWE-347) lies in OpenAM's RADIUS client implementation, which opens an unconnected UDP datagram socket and accepts the first datagram delivered to its source port as authoritative. The receive path fails to validate the source IP/port, does not match the response identifier against the outstanding request, and does not verify the Response Authenticator as required by RFC 2865 §3; additionally, the RFC 2869 Message-Authenticator is neither sent nor required. Because any non-Reject/non-Challenge packet is treated as a successful authentication, an attacker can forge an Access-Accept packet without needing to perform MD5 chosen-prefix forgery — making this materially easier to exploit than the related BlastRADIUS family (CVE-2024-3596). The attack vector is adjacent network with high attack complexity, requiring no privileges or user interaction (GitHub Advisory, OpenAM Advisory).

Successful exploitation allows an unauthenticated attacker to impersonate any RADIUS-mapped user in any affected OpenAM realm, obtaining a session indistinguishable from a legitimate RADIUS login that carries the named principal's full privileges. This results in high confidentiality, integrity, and availability impact, as the attacker gains unauthorized access to protected resources, can modify data, and may disrupt services. The vulnerability is only exploitable in deployments where an administrator has enabled a RADIUS module instance on a login chain (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The vulnerability was discovered and reported by researcher "wodzen" and disclosed alongside the patch on June 25, 2026. The attack requires network adjacency and high complexity (either racing the real RADIUS server on-path or spraying forged UDP packets off-path), which limits opportunistic exploitation. The CVE status is listed as Reserved, and no EPSS score or CISA KEV catalog entry has been identified (GitHub Advisory, OpenAM Release).

1. Reconnaissance: Identify OpenAM deployments (version ≤ 16.0.6) that have a RADIUS authentication module enabled in a login chain. This can be done via network scanning for OpenAM login pages and probing for RADIUS UDP traffic.
2. Identify the RADIUS client port: Determine the UDP source port that the OpenAM RADIUS client uses when sending Access-Request packets to the RADIUS server (typically ephemeral, but observable via network sniffing if on-path).
3. Trigger a RADIUS authentication request: Initiate a login attempt against the OpenAM instance using a known or guessed RADIUS username (no valid password required), causing OpenAM to send an Access-Request UDP packet to the configured RADIUS server.
4. Race or spray forged Access-Accept: Either (a) on-path: intercept the Access-Request and immediately send a forged Access-Accept UDP packet back to the OpenAM client port before the real server responds, or (b) off-path: spray multiple forged Access-Accept UDP packets to the OpenAM client's source port, relying on the lack of source IP/port and identifier validation to have one accepted.
5. Obtain session: Because OpenAM does not verify the Response Authenticator or Message-Authenticator, the forged packet is accepted as a valid login, and the attacker receives a legitimate OpenAM session token for the targeted username with that user's full privileges (GitHub Advisory, OpenAM Advisory).

• Network: Unexpected UDP packets sent to the OpenAM server's ephemeral RADIUS client port from sources other than the configured RADIUS server IP; multiple rapid UDP datagrams targeting the OpenAM RADIUS client port during an active authentication session.
• Logs: OpenAM authentication logs showing successful RADIUS logins for privileged accounts at unusual times or from unexpected IP addresses; RADIUS server logs showing no corresponding Access-Request/Access-Accept exchange for a session that OpenAM recorded as successful.
• Application: OpenAM session records for RADIUS-authenticated users created without a corresponding entry in the RADIUS server's accounting logs; sessions established for accounts that should not have RADIUS access.

The vulnerability has been patched in OpenAM Community Edition version 16.1.1. All users running version 16.0.6 or earlier with a RADIUS module enabled in a login chain should upgrade immediately (OpenAM Release). As a temporary workaround, administrators can disable the RADIUS authentication module from all login chains until the upgrade can be applied. Additionally, network-level controls such as firewall rules restricting UDP traffic to the OpenAM RADIUS client port to only the trusted RADIUS server IP can reduce the attack surface for off-path spoofing attempts (GitHub Advisory).

The vulnerability was reported by security researcher "wodzen," who also discovered several other significant vulnerabilities in OpenAM that were patched simultaneously in version 16.1.1, including session hijacking, deserialization, and OAuth bypass issues. The advisory was published and reviewed by the OpenIdentityPlatform maintainers on the same day as the patch release, indicating a coordinated disclosure process. No significant broader media coverage or social media discussion has been identified beyond the GitHub advisory and OSV database entry (GitHub Advisory, OpenAM Release).