GHSA-39hr-239p-fhqc

Source

https://github.com/advisories/GHSA-39hr-239p-fhqc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-39hr-239p-fhqc/GHSA-39hr-239p-fhqc.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-39hr-239p-fhqc

Aliases

CVE-2025-64099

Published

2025-11-12T21:27:22Z

Modified

2025-11-15T03:34:07.748195Z

Severity

8.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U CVSS Calculator

Summary

OpenAM: Using arbitrary OIDC requested claims values in id_token and user_info is allowed

Details

Summary

If the "claimsparametersupported" parameter is activated, it is possible through the "oidc-claims-extension.groovy" script, to inject the value of choice into a claim contained in the idtoken or in the userinfo. Authorization function requests do not prevent a claims parameter containing a JSON file to be injected. This JSON file allows users to customize claims returned by the "idtoken" and "userinfo" files. This allows for a very wide range of vulnerabilities depending on how clients use claims. For example, if some clients rely on an email field to identify a user, users can choose to entera any email address, and therefore assume any chosen identity.

Database specific

{
    "github_reviewed": true,
    "severity": "HIGH",
    "cwe_ids": [
        "CWE-74",
        "CWE-94"
    ],
    "nvd_published_at": "2025-11-12T19:15:38Z",
    "github_reviewed_at": "2025-11-12T21:27:22Z"
}

References

Affected packages

Maven / org.openidentityplatform.openam:openam-oauth2

Package

Name: org.openidentityplatform.openam:openam-oauth2; View open source insights on deps.dev
Purl: pkg:maven/org.openidentityplatform.openam/openam-oauth2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

16.0.3

Affected versions

14.*

14.5.2

14.5.3

14.5.4

14.6.1

14.6.2

14.6.3

14.6.4

14.6.5

14.6.6

14.7.0

14.7.1

14.7.2

14.7.3

14.7.4

14.8.1

14.8.2

14.8.3

14.8.4

15.*

15.0.0

15.0.1

15.0.2

15.0.3

15.0.4

15.1.0

15.1.1

15.1.2

15.1.3

15.1.4

15.1.5

15.1.6

15.2.0

15.2.1

15.2.2

16.*

16.0.1

16.0.2