CVE-2026-123545
HIGH
NVD
CVSS Score
7.1
Severity
HIGH
Published
Nov 08, 2026
Vendor
unknown
Description
OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device authorization flow that allows attackers to approve device codes when consent is skipped for implied-consent clients. Attackers can start a device authorization and lure a logged-in user to a crafted page, obtaining access and ID tokens to call APIs as that user.