CVE-2026-46560
- Source
- https://cve.org/CVERecord?id=CVE-2026-46560
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46560.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-46560
- Aliases
- Published
- 2026-10-30T18:36:24Z
- Modified
- 2026-10-31T13:20:12Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- OpenAM Authentication Bypass via RADIUS Spoofing
- Details
-
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the
RADIUSauthentication module opens an unconnected datagram socket and trusts the first UDP datagram received on the client source port. The receive path does not verify the source IP and port, match the response identifier to the outstanding request, or verify the RFC 2865Response Authenticator; the RFC 2869Message-Authenticatoris neither sent nor required. Any non-Reject/non-Challenge packet is treated as success. On a deployment with aRADIUSmodule instance enabled on a login chain, an unauthenticated network attacker can race the real server on-path or spray forgedAccess-Acceptpackets off-path and obtain a session for anyRADIUS-mapped username without knowing the shared secret. Unlike CVE-2024-3596, exploitation requires no MD5 chosen-prefix forgery because no response authenticator is checked. The resulting session carries the impersonated principal's privileges. This issue is fixed in version 16.1.1. - Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-347" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46560.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46560.json
- https://github.com/OpenIdentityPlatform/OpenAM/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775
- https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1
- https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-386j-6m86-78f9
- https://nvd.nist.gov/vuln/detail/CVE-2026-46560
Affected packages
Git / github.com/openidentityplatform/openam
Affected ranges
- Type
- GIT
- Repo
- https://github.com/openidentityplatform/openam
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "16.1.1" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "16.1.1", "range": [ { "fixed": "fe2271ec119e827b4252cec20293480322a84789" } ], "source": "REFERENCES_TAG" } ] }
Affected versions
13.*
13.0.0
13.0.0-RC1
13.0.0-RC10
13.0.0-RC2
13.0.0-RC3
13.0.0-RC4
13.0.0-RC5
13.0.0-RC6
13.0.0-RC7
13.0.0-RC8
13.0.0-RC9
14.*
14.0.0
14.0.1
14.0.2
14.0.3
14.0.4
14.0.5
14.0.6
14.1.1
14.1.10
14.1.11
14.1.12
14.1.13
14.1.16
14.1.17
14.1.2
14.1.3
14.1.4
14.1.5
14.1.6
14.1.7
14.1.8
14.1.9
14.2.1
14.2.2
14.3.1
14.4.1
14.4.2
14.5.1
14.5.2
14.5.3
14.5.4
14.6.2
14.6.3
14.6.4
14.6.5
14.6.6
14.7.0
14.7.1
14.7.2
14.7.3
14.7.4
14.8.1
14.8.2
14.8.3
14.8.4
15.*
15.0.0
15.0.1
15.0.2
15.0.3
15.0.4
15.1.0
15.1.1
15.1.2
15.1.3
15.1.4
15.1.5
15.1.6
15.2.0
15.2.1
15.2.2
16.*
16.0.3
16.0.4
16.0.5
16.0.6
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46560.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "251237120994908528631026416952304053783",
"length": 163
},
"id": "CVE-2026-46560-0928f043",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775",
"target": {
"file": "openam-authentication/openam-auth-radius/src/main/java/com/sun/identity/authentication/modules/radius/client/RadiusConn.java",
"function": "RadiusConn"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "315440013065949253901816301387122196614",
"length": 5708
},
"id": "CVE-2026-46560-16c92dee",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775",
"target": {
"file": "openam-authentication/openam-auth-radius/src/main/java/com/sun/identity/authentication/modules/radius/RADIUS.java",
"function": "process"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "84972319956435951221893659876196463491",
"length": 531
},
"id": "CVE-2026-46560-1826d943",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775",
"target": {
"file": "openam-authentication/openam-auth-radius/src/main/java/com/sun/identity/authentication/modules/radius/client/RadiusConn.java",
"function": "send"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "192360785585113485020441215419081278474",
"length": 160
},
"id": "CVE-2026-46560-294fa85d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775",
"target": {
"file": "openam-authentication/openam-auth-radius/src/main/java/com/sun/identity/authentication/modules/radius/client/RadiusConn.java",
"function": "RadiusConn"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"71586142033044627450385040065707115535",
"338623533446564925999858103757017294840",
"325458253999767970688565962511525421844",
"36585707467160199722361754685082470318",
"307957436163256398284560049876375508749",
"1273753730293786291054478224246424185",
"162159187030399478407746743880107687472",
"230414195021283019502228259272609315705",
"251675568761900897333304492036086079454",
"332173243347309245424000861865702605547",
"304923557415220894557911544402310612034",
"319904910560282733558355917377290588423",
"282452285550427761825809010555401548288",
"174229307039302799883369858104070218389",
"325657108983168831134033566039722156596",
"185618224766035830151144761143319816576",
"151506646185854322583979048190336090579",
"141819019222715323180184968848377134216",
"340160441993501403808374760850862740897",
"162164033242916573152170805934907998014",
"240961126943607662259376975403302287128",
"320055390547934259808678222781107578764",
"281489763498874081827539569738821796556",
"331756078453733290016966284267232582211",
"84135516376829414090600985903503921415",
"141910812228598010543916196544974511675",
"192127127789138665521483724650203237741",
"83482432519205413475265722906417024621",
"235686627601350612703653275194963701473",
"82507251441664006998940422962846658692",
"124757479717626216773150561132522210736",
"258572067958388974072733459908226096623",
"87039231161800679506808265838961898106",
"315135507206368983260339043409875131604",
"172632474161859568464136510665390175459",
"259109423987031962491672005905988457822",
"337678497014578674104993272068030987634",
"315667738479837340519881149482070206466",
"181241879239448904347891631513450636875",
"168768741943604495963050720897949349445",
"326221310082279861661814219919595837261",
"155436575040096761903464964552929497918",
"93596907851292830967003642155816963662",
"205332677339238575379202785057763570267",
"59368329814563589739371461002722272447",
"148550794097976237056043201903428295454",
"315911783941868711970896474212277902575",
"109152734672874790267082631558018044053",
"281099840410619300940642805985223319476",
"178710204296015650686685062480639226582",
"256802558253749104357824968875902600216",
"101899549388559483453900537815484282399",
"97135194877054744749376132753737826909",
"232416158445008685598611918378820399428",
"234190543195650652748511295336555300314",
"32653126130813239856338852323366198277",
"198281112323749136560550469006229951997",
"41771871763597611478476232932157781884",
"101001884853719323741238751598739611399",
"130976725892540063120045411117822857839",
"83582866050722682366249530753595673251",
"129446691602103381940521990476591552371",
"319312887734020007414072052487166183550",
"66119591857539517868342142614660052220",
"185926246570646504216235813152279793671",
"225491718499369087950284120959608972604",
"231293499612866877158253954647075280763",
"307402223567879079572848975424178576287",
"299157809005338775715768739955646136080",
"218900369030130613677605027020664499573",
"257899220450242441047853197163409082091",
"156487259784899032144833865105818822390",
"34603382860227689308377608335416828990",
"333611518383318162167932802643901024482",
"279650452234868716581894227299143590930",
"97603619892706879258848702159813072051",
"320286018785994392258778824482035368398",
"181711060876437964299880735050232061552",
"114240194985819813327716883927678398747",
"90278503651662296094842237037141353976",
"172145317422568019590076237566826960344",
"4111807553134856184280523615889687384",
"20776399007806634958527448858532954930",
"165756904658331432729374045596418090514",
"97135194877054744749376132753737826909",
"176986907800006272736336941243942187921",
"198912757285184139965757397664050565896",
"268267698258134499089481209763858680711",
"271056682935296333221565769723252948089",
"49937704052300249968717202827379008642",
"268802665949476945670521101165971547801",
"7851865150310207690870964136662286293",
"18808540065616570449771792039639439084",
"293060144257239399852338901233378230066",
"71080375152766150595887234917765532870",
"263728723448941480176598476368715470182",
"89905735713861219210615611794136056586",
"308234454645065096897671340427270027137",
"315139154777897936625038092828133059191",
"11708675512528735359475919490329295109",
"5440055700691027097044214700121273689",
"108587633537507210242609878158511307392"
],
"threshold": 0.9
},
"id": "CVE-2026-46560-2d5709b7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775",
"target": {
"file": "openam-authentication/openam-auth-radius/src/main/java/com/sun/identity/authentication/modules/radius/client/RadiusConn.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "337169586693606197193278288479672394582",
"length": 1022
},
"id": "CVE-2026-46560-462323ee",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775",
"target": {
"file": "openam-authentication/openam-auth-radius/src/main/java/com/sun/identity/authentication/modules/radius/client/RadiusConn.java",
"function": "sendPacket"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "327749082637802741730466979952573036609",
"length": 2704
},
"id": "CVE-2026-46560-50c236b1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775",
"target": {
"file": "openam-radius/openam-radius-common/src/main/java/org/forgerock/openam/radius/common/AttributeFactory.java",
"function": "createAttribute"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"56138788554943747616724106122462014481",
"239168523684862350437498139926096179422",
"216532935114015461473688800853006973444"
],
"threshold": 0.9
},
"id": "CVE-2026-46560-71c18875",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775",
"target": {
"file": "openam-radius/openam-radius-common/src/main/java/org/forgerock/openam/radius/common/AttributeSet.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "10292373518357251307755911992382773274",
"length": 1605
},
"id": "CVE-2026-46560-77ed4e3e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775",
"target": {
"file": "openam-authentication/openam-auth-radius/src/main/java/com/sun/identity/authentication/modules/radius/client/RadiusConn.java",
"function": "run"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "110153810770379898923573545858031032806",
"length": 65
},
"id": "CVE-2026-46560-9cc9926a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775",
"target": {
"file": "openam-authentication/openam-auth-radius/src/main/java/com/sun/identity/authentication/modules/radius/client/RadiusConn.java",
"function": "disconnect"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"332948839581005097435660454156215631760",
"211929672977374675987134090160123787207",
"166023417562933338667384411285583054494",
"53505067550883821089491587316461031674",
"221288278349825224645968092954147721080"
],
"threshold": 0.9
},
"id": "CVE-2026-46560-a3c0915c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775",
"target": {
"file": "openam-radius/openam-radius-common/src/main/java/org/forgerock/openam/radius/common/AttributeFactory.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"204649955623417199666007154341759282641",
"19636428987238387958149013574734220674",
"185838351479549880803485264656842923192",
"204716541900627851870235082165670189254",
"183576817057949061034871549966774064821",
"117215259243786710312753843505035675026",
"272627965917126368218742912167030176968",
"288043333985949123063865171808687079785",
"159498708004820102953966973680619344095",
"277345353882222224888119110947020902228",
"154230027290254969845310040712763934858",
"323085596837933930512205662609690723540"
],
"threshold": 0.9
},
"id": "CVE-2026-46560-a9f5c578",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775",
"target": {
"file": "openam-authentication/openam-auth-radius/src/main/java/com/sun/identity/authentication/modules/radius/RADIUS.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"167879494323924328848214120721920597773",
"331347973398505739998762993618292365806",
"29657130986881719955706985902743672356",
"59201517073040126134205956830535729972",
"90521971688286901917565086517753317606",
"311423203721786652041109666537256894976",
"12647774837979104491678561346903457739"
],
"threshold": 0.9
},
"id": "CVE-2026-46560-e13b5cb6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775",
"target": {
"file": "openam-radius/openam-radius-common/src/main/java/org/forgerock/openam/radius/common/PacketFactory.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "205503834128153942531870465261460492886",
"length": 175
},
"id": "CVE-2026-46560-e6471613",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775",
"target": {
"file": "openam-radius/openam-radius-common/src/main/java/org/forgerock/openam/radius/common/PacketFactory.java",
"function": "toPacket"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "47317284111521044153826404787662575869",
"length": 524
},
"id": "CVE-2026-46560-e851d453",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775",
"target": {
"file": "openam-authentication/openam-auth-radius/src/main/java/com/sun/identity/authentication/modules/radius/client/RadiusConn.java",
"function": "RadiusConn"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "241371023892555501444050763811510862922",
"length": 365
},
"id": "CVE-2026-46560-eabd4598",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775",
"target": {
"file": "openam-authentication/openam-auth-radius/src/main/java/com/sun/identity/authentication/modules/radius/client/RadiusConn.java",
"function": "receive"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"163902533351650869307562520408881200921",
"119008768319636659299992706557055359353",
"10258181064199284641030788577283615179",
"99703002050037390255751066138083617197",
"180017523590254477462056651424061923440"
],
"threshold": 0.9
},
"id": "CVE-2026-46560-ef49b4d6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775",
"target": {
"file": "openam-radius/openam-radius-common/src/main/java/org/forgerock/openam/radius/common/AttributeType.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "142231389118063151931290157544346004879",
"length": 2880
},
"id": "CVE-2026-46560-f3bbadf3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openidentityplatform/openam/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775",
"target": {
"file": "openam-authentication/openam-auth-radius/src/main/java/com/sun/identity/authentication/modules/radius/RADIUS.java",
"function": "init"
}
}
]
vanir_signatures_modified
"2026-10-31T13:20:12Z"