CyberRota Analysis
AI-GeneratedThe OAuth2 authentication module in Open Access Management (OpenAM) versions prior to 16.1.1 is vulnerable to an account takeover attack, where an unauthenticated attacker can exploit the lack of filtering in the account update process to overwrite user passwords with their usernames. This vulnerability allows attackers to reactivate disabled accounts and gain unauthorized access without needing to authenticate through the identity provider. Organizations using affected versions should prioritize upgrading to version 16.1.1 to mitigate the risk of credential compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth2 authentication module updates an existing local account with profile attributes that can include userPassword and inetUserStatus, rewriting the password to the username and reactivating disabled accounts. The missing OAuth.removeRestrictedAccountUpdateAttributes filtering permits these credential and status fields to reach the account update. With account creation enabled, repeated OAuth login causes the default ldapService chain to accept the username as both identifier and password, allowing an unauthenticated attacker to take over the local account without interacting with the identity provider. The rewrite can be denied for usernames shorter than the configured minimum password length. This issue is fixed in version 16.1.1.