OpenIdentityPlatform's advisory rates it CVSS 3.1 9.8 Critical and fixed it in OpenAM 16.1.4.
What it allows
CVE-2026-123549 is a gap in how OpenAM checks self-registration input. OpenAM is an open source access management server from the OpenIdentityPlatform project. When a user self-registers, the server should only accept attributes on its Valid Creation Attributes list.
The advisory says that check does not fully run. Accounts are created with the server's own admin credentials, so values that should be refused, including group membership, are written to the new account as supplied.
Two flows are affected. The legacy self-service REST endpoint applies no attribute restriction at all, and the current User Self-Service flow does not restrict group membership. The advisory says only realms with self-registration turned on are exposed, and self-registration is off by default in both settings.
What CVE-2026-123549 Lets an Attacker Do
An anonymous visitor who can complete self-registration, which the advisory says normally needs only an email address the attacker controls, can join any existing group. Where an admin group exists, the result is full admin control: reading and changing all identities, and creating further admin accounts.
The advisory also closes two related weaknesses. The legacy endpoint could store an email address other than the one registration verified. An authenticated user could also use the same action to create groups or agents with the server's own credentials.
CVSS Score and CWE for CVE-2026-123549
VulnCheck, the CNA, scores CVE-2026-123549 as CVSS v3.1 9.8 Critical, with CVSS v4.0 9.3 Critical as a secondary metric. The advisory lists the same 9.8 score and does not publish a CVSS v4.0 vector.
The CVE record lists the primary weakness as CWE-269, improper privilege management. The advisory also maps a second weakness, CWE-915, for how the server applies attributes it receives from the registration request. See our CVSS entry for how to read the score.
What OpenIdentityPlatform and CISA KEV Say
The advisory says OpenAM 16.1.4 is the first fixed release, and all earlier releases are affected. As of CISA catalog version 2026.11.06, CVE-2026-123549 is not in the Known Exploited Vulnerabilities catalog. The advisory and the CVE record do not state whether the flaw has been exploited. Our KEV glossary entry explains the catalog.
Who is affected
The CVE record and the advisory both list OpenAM up to and including 16.1.3 as affected. The advisory names the core REST module and OpenAM 16.1.4 as the first fixed release.
Fixed in 16.1.4, self-registration enforces the Valid Creation Attributes list on every flow, including group membership, and the server creates nothing but users. After the upgrade, the advisory says a registration request carrying any attribute outside that list is refused.
The advisory warns that a registration form or client sending profile fields beyond the shipped list needs those fields added to it before upgrading. Deployments that customised the list should check it too, and keep mail in it, since the server adds the verified address itself.
GHSA-jv8f-m88g-h6mm credits santhreal and jamesbishup as reporters. We recommend planning the version upgrade with our vulnerability management guide.
OpenAM 16.1.4 also fixes two other critical flaws we cover separately: a SAML authentication bypass, CVE-2026-123550, and a session-token disclosure, CVE-2026-123551. Deployments on 16.1.3 or earlier should patch for all three.
Timeline
- 22 Oct 2026
OpenIdentityPlatform releases OpenAM 16.1.4 and publishes the advisory GHSA-jv8f-m88g-h6mm.
- 6 Nov 2026
VulnCheck, the CNA, reserves CVE-2026-123549, per the CVE record.
- 8 Nov 2026
VulnCheck publishes the CVE record, and NVD publishes its entry.
What to do
-
Find Every Realm With Self-Registration On
List every realm where self-registration is enabled, in both the legacy self-service settings and the current User Self-Service service. The advisory says it is off by default in both.
-
Upgrade to OpenAM 16.1.4
The advisory says 16.1.4 enforces the Valid Creation Attributes list on every registration flow, including group membership. This is a mandatory version change, not a configuration setting.
-
Disable Self-Registration Until You Upgrade
The advisory recommends disabling self-registration in every realm that does not need it, as the fastest workaround before 16.1.4 is deployed. Check both the legacy and current self-service settings.
-
Harden Self-Registration Where It Must Stay On
If self-registration must stay on, the advisory says to use only the current flow, not the legacy endpoint. At the reverse proxy, reject any request that sets group membership or an attribute outside the allowed list.
-
Review Self-Registered Accounts and Monitor New Ones
We recommend checking the group memberships of self-registered accounts, especially admin groups, and removing anything unexpected. The advisory also says to monitor new account creation and changes to privileged group membership.
Frequently Asked Questions
Which OpenAM versions does CVE-2026-123549 affect?
The CVE record and the advisory both list OpenAM up to and including 16.1.3 as affected. OpenAM 16.1.4 is the first fixed release.
Does an attacker need an account to exploit this flaw?
No. The advisory says an anonymous visitor can complete self-registration, which normally needs only an email address the attacker controls.
Is self-registration enabled by default in OpenAM?
No. The advisory says self-registration is off by default in both the legacy and current self-service settings.
What can the attacker do after self-registering?
The advisory says the attacker can join any existing group, including an admin one. Where an admin group exists, the result is full admin control of OpenAM.
Is CVE-2026-123549 in the CISA KEV catalog?
It is not in catalog version 2026.11.06. The advisory and the CVE record do not state whether the flaw has been exploited.
Sources
- CVE-2026-123549 RecordCVE Program / VulnCheck CNA
- CVE-2026-123549NVD
- GHSA-jv8f-m88g-h6mm, OpenAM self-registration does not enforce the allowed attribute listOpenAM on GitHub
- OpenAM 16.1.4 release notesOpenAM on GitHub
- OpenAM before 16.1.4 Privilege Escalation via Self-Registration Attribute BypassVulnCheck
- Known Exploited Vulnerabilities CatalogCISA
