OpenAM: Privilege escalation via self-registration (CVE-2026-123549)

ForgeRock OpenAM versions prior to 16.1.4 contain a vulnerability in the self-registration process that fails to enforce the Valid Creation Attributes list. This flaw allows unauthenticated attackers to supply restricted attributes, such as group memberships, when registering a new account. By manipulating these attributes during the self-registration flow or via the legacy self-service REST API, an attacker can assign their account to administrative groups, resulting in full administrative control over the OpenAM instance.

Impact

Successful exploitation allows an unauthenticated user to achieve full administrative control over the target OpenAM installation.

Recommendation

• Upgrade ForgeRock OpenAM to version 16.1.4 or later immediately to patch CVE-2026-123549.
• Temporarily disable the User Self-Service and legacy self-service REST endpoints until the patch can be applied if immediate patching is not possible.
• Review OpenAM audit logs for anomalous account creations or modifications to group memberships by newly created accounts.