CVE-2026-123549
CRITICAL
NVD
CVSS Score
9.8
Severity
CRITICAL
Published
Nov 08, 2026
Vendor
unknown
Description
OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, allowing anonymous attackers to set restricted attributes including group membership. Attackers can register through the legacy self-service REST endpoint or User Self-Service flow to join administrative groups and gain full administrative control of OpenAM.