OpenAM (< 16.1.4) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/openam--16.1.4/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 08 Nov 2026 02:55:22 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOpenAM: Privilege escalation via self-registration (CVE-2026-123549)https://feed.craftedsignal.io/briefs/2026-11-openam-cve-2026-123549/Sun, 08 Nov 2026 02:55:22 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-openam-cve-2026-123549/ForgeRock OpenAM versions prior to 16.1.4 are vulnerable to an attribute injection flaw during self-registration that allows unauthenticated attackers to elevate privileges by joining administrative groups.ForgeRock OpenAM versions prior to 16.1.4 contain a vulnerability in the self-registration process that fails to enforce the Valid Creation Attributes list. This flaw allows unauthenticated attackers to supply restricted attributes, such as group memberships, when registering a new account. By manipulating these attributes during the self-registration flow or via the legacy self-service REST API, an attacker can assign their account to administrative groups, resulting in full administrative control over the OpenAM instance.

Impact

Successful exploitation allows an unauthenticated user to achieve full administrative control over the target OpenAM installation.

Recommendation

  • Upgrade ForgeRock OpenAM to version 16.1.4 or later immediately to patch CVE-2026-123549.
  • Temporarily disable the User Self-Service and legacy self-service REST endpoints until the patch can be applied if immediate patching is not possible.
  • Review OpenAM audit logs for anomalous account creations or modifications to group memberships by newly created accounts.
]]>criticaladvisory