CyberRota Analysis
AI-GeneratedOpenAM's AuthorizationCodeGrantTypeHandler is vulnerable due to improper handling of the code_verifier parameter, allowing attackers to exploit PKCE-protected authorization codes when the realm-wide codeVerifierEnforced setting is disabled by default. This critical vulnerability can lead to unauthorized access, particularly affecting public clients, while confidential clients may also be at risk if client authentication materials are compromised. Organizations using OpenAM versions prior to 16.1.1 should prioritize immediate updates to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a code_verifier only when the realm-wide codeVerifierEnforced setting is enabled, even when an authorization code stores a code_challenge. Because that setting is disabled by default, an attacker who intercepts a PKCE-protected authorization code can omit code_verifier and redeem the code, while an explicitly incorrect verifier is rejected. Public clients are directly affected, and confidential-client exploitation additionally requires client authentication material or another redemption context. This issue is fixed in version 16.1.1.