OpenAM CVE-2025-5449: Arbitrary OAuth Token Minting via Push Registration

Vulnerability Overview Title: OpenAM Arbitrary OAuth Token Minting via Push Registration CVE ID: CVE-2025-5449 Severity: High Description: A privilege bypass vulnerability exists in the stateful OAuth2 token read path in OpenAM (CWE-639). Under specific conditions, an attacker can leverage a user-controllable Key (CWE-639) to bypass authorization checks, allowing the forging of arbitrary OAuth2 Bearer Tokens and OIDC ID Tokens (with arbitrary subject, client, realm, and scope). Root Cause: When the read path retrieves a token identifier from the shared Core Token Store (CTS), it fails to bind the token to the correct trusted CTS type. This allows an attacker to insert arbitrary JSON into the shared CTS via a low-privileged user’s Push Notification, causing the BLOB claim to be accepted as an OAuth token without integrity verification. Affected Scope Affected Package: Affected Versions: Fixed Version: Impact Statement: - Realms running OpenAM Community Edition (version ≤ 16.0.6) with the OAuth2 Provider service enabled are at risk. - The vulnerable path is only exploitable if the attacker can insert arbitrary JSON into the shared CTS. - An attacker can forge arbitrary OAuth2 Bearer Tokens (specifying username, clientID, realm, and scope), but this does not automatically create an OpenAM SSO session or grant access to the admin-console. Remediation Fixed in OpenAM Community Edition 16.1.1. Users are advised to upgrade to the latest version. POC / Exploitation Code The documentation does not include POC code or an exploit code block.

Goal Reached Thanks to every supporter — we hit 100%!

OpenAM CVE-2025-5449: Arbitrary OAuth Token Minting via Push Registration

More from this source