CVE-2026-47426

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the private_key_jwt client authentication path uses ClientJwksResolverCache without reliably binding a cached jwks_uri resolver and verified assertion to the expected clientID in ClientCredentialsReader. An attacker controlling any registered client with published keys, including one obtained through open dynamic registration when enabled, can authenticate as another client whose keys are exposed through jwks_uri and mint tokens in that client's name across realms in the same OpenAM process. This issue is fixed in version 16.1.1.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-287"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47426.json"
}

References

Affected packages

Git / github.com/openidentityplatform/openam

Affected ranges

Type

GIT

Repo

https://github.com/openidentityplatform/openam

Events

Introduced

Fixed

91acaf499162097ec83bcd729275ba7a12e1bd21

Fixed

fe2271ec119e827b4252cec20293480322a84789

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "16.1.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

13.*

13.0.0

13.0.0-RC1

13.0.0-RC10

13.0.0-RC2

13.0.0-RC3

13.0.0-RC4

13.0.0-RC5

13.0.0-RC6

13.0.0-RC7

13.0.0-RC8

13.0.0-RC9

14.*

14.0.0

14.0.1

14.0.2

14.0.3

14.0.4

14.0.5

14.0.6

14.1.1

14.1.10

14.1.11

14.1.12

14.1.13

14.1.16

14.1.17

14.1.2

14.1.3

14.1.4

14.1.5

14.1.6

14.1.7

14.1.8

14.1.9

14.2.1

14.2.2

14.3.1

14.4.1

14.4.2

14.5.1

14.5.2

14.5.3

14.5.4

14.6.2

14.6.3

14.6.4

14.6.5

14.6.6

14.7.0

14.7.1

14.7.2

14.7.3

14.7.4

14.8.1

14.8.2

14.8.3

14.8.4

15.*

15.0.0

15.0.1

15.0.2

15.0.3

15.0.4

15.1.0

15.1.1

15.1.2

15.1.3

15.1.4

15.1.5

15.1.6

15.2.0

15.2.1

15.2.2

16.*

16.0.3

16.0.4

16.0.5

16.0.6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47426.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "115459833131441974999634753008340093886",
            "length": 1026
        },
        "id": "CVE-2026-47426-5fd94ce6",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openidentityplatform/openam/commit/91acaf499162097ec83bcd729275ba7a12e1bd21",
        "target": {
            "file": "openam-oauth2/src/main/java/org/forgerock/openam/oauth2/OpenAMClientRegistration.java",
            "function": "byJWKsURI"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "76719580783580380247406194617536947432",
                "106266124431217943896115751258638213709",
                "14846866107931077470952724601465303150",
                "66828605565131106547297147669771501941",
                "333247980984069153540658362813883223426",
                "67279835741978497102226326726388992924",
                "126359968934986902588048094816020098105",
                "236890982907304452155828823486157952075",
                "256275116887044047833895229519741703316",
                "98810485167392280668544108915737638861",
                "176547096881566293291401564468608306388",
                "285952999199802848693925276017707088268",
                "293441670611043875713054280316619317149",
                "88870747826464510855596381342775493118",
                "144599272593940751745742670711397208257",
                "306413752294693311095944144299140624829",
                "200516912756854292924160619320475919012",
                "299847715971733018325679184583404845870",
                "72030262963776383081512710617952154082",
                "235222450654742132063586188135702216354",
                "164167785910121186250129514878808833372",
                "269091466555279192234214205092557595495",
                "319726597403827942181505782185266764025",
                "260119148842411927357046234863374490440"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-47426-61a0225c",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openidentityplatform/openam/commit/91acaf499162097ec83bcd729275ba7a12e1bd21",
        "target": {
            "file": "openam-oauth2/src/main/java/org/forgerock/openam/oauth2/OpenAMClientRegistration.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "148873931726372208989164546403819530912",
            "length": 930
        },
        "id": "CVE-2026-47426-8f44d655",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openidentityplatform/openam/commit/91acaf499162097ec83bcd729275ba7a12e1bd21",
        "target": {
            "file": "openam-oauth2/src/main/java/org/forgerock/openam/oauth2/ClientCredentialsReader.java",
            "function": "verifyJwtBearer"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "229761424623118338958876983740596733456",
                "271873967078813910602306209324902450827",
                "248540800441707414626526636673042833060",
                "57305161958980584513597034377410071970",
                "264203269223668814716675099658891665256"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-47426-befd7bc1",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openidentityplatform/openam/commit/91acaf499162097ec83bcd729275ba7a12e1bd21",
        "target": {
            "file": "openam-oauth2/src/main/java/org/forgerock/openam/oauth2/ClientCredentialsReader.java"
        }
    }
]

vanir_signatures_modified

"2026-09-18T08:10:17Z"