{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/openam--16.1.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:forgerock:openam:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-123549"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenAM (\u003c 16.1.4)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["ForgeRock"],"content_html":"\u003cp\u003eForgeRock OpenAM versions prior to 16.1.4 contain a vulnerability in the self-registration process that fails to enforce the Valid Creation Attributes list. This flaw allows unauthenticated attackers to supply restricted attributes, such as group memberships, when registering a new account. By manipulating these attributes during the self-registration flow or via the legacy self-service REST API, an attacker can assign their account to administrative groups, resulting in full administrative control over the OpenAM instance.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated user to achieve full administrative control over the target OpenAM installation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade ForgeRock OpenAM to version 16.1.4 or later immediately to patch CVE-2026-123549.\u003c/li\u003e\n\u003cli\u003eTemporarily disable the User Self-Service and legacy self-service REST endpoints until the patch can be applied if immediate patching is not possible.\u003c/li\u003e\n\u003cli\u003eReview OpenAM audit logs for anomalous account creations or modifications to group memberships by newly created accounts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T02:55:22Z","date_published":"2026-11-08T02:55:22Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openam-cve-2026-123549/","summary":"ForgeRock OpenAM versions prior to 16.1.4 are vulnerable to an attribute injection flaw during self-registration that allows unauthenticated attackers to elevate privileges by joining administrative groups.","title":"OpenAM: Privilege escalation via self-registration (CVE-2026-123549)","url":"https://feed.craftedsignal.io/briefs/2026-11-openam-cve-2026-123549/"}],"language":"en","title":"CraftedSignal Threat Feed - OpenAM (\u003c 16.1.4)","version":"https://jsonfeed.org/version/1.1"}