CVE-2026-123545 OpenAM 14.5.1 before 16.1.4 CSRF in OAuth 2.0 Device Flow
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123545?
CVE-2026-123545 is a high-severity vulnerability in OpenIdentityPlatform OpenAM, published on 8 Nov 2026.
Official description
OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device authorization flow that allows attackers to approve device codes when consent is skipped for implied-consent clients. Attackers can start a device authorization and lure a logged-in user to a crafted page, obtaining access and ID tokens to call APIs as that user.
Weakness: CWE-352
Which versions are affected by CVE-2026-123545?
How do I fix CVE-2026-123545?
No fix has been published for CVE-2026-123545 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123545 being exploited?
There is no known exploitation of CVE-2026-123545 in the wild and no public exploit code.
Sources
Also known as GHSA-29cx-77jg-5p59, GHSA-545c-rm35-2jj2.