CVE-2026-105119 OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows
Attackers can bypass PKCE enforcement in OpenAM hybrid OAuth flows to intercept authorization codes and steal tokens, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-105119?
CVE-2026-105119 is a high-severity authentication bypass vulnerability in OpenIdentityPlatform OpenAM, published on 3 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose response_type is exactly code, so codes issued through OpenID Connect hybrid flows (code token, code id_token, code token id_token) carry no bound challenge. An attacker who intercepts such a code can redeem it for a public client's tokens with any non-empty code_verifier.
Weakness: CWE-285
Which versions are affected by CVE-2026-105119?
How do I fix CVE-2026-105119?
No fix has been published for CVE-2026-105119 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-105119 being exploited?
There is no known exploitation of CVE-2026-105119 in the wild and no public exploit code.
Sources
Also known as GHSA-5p2f-7vcr-6vfh, GHSA-mf8f-w84m-x4gc.