CVE-2026-105119

{
  "etk_id": "ETK-2026-461",
  "cve_id": "CVE-2026-105119",
  "display_id": "CVE-2026-105119",
  "ghsa_id": "GHSA-5p2f-7vcr-6vfh",
  "euvd_id": "EUVD-2026-92023",
  "status": "published",
  "anchor_state": "anchored",
  "title": "PKCE enforcement bypass in OpenAM hybrid OAuth flows",
  "summary": "OpenAM versions before 16.1.3 do not bind PKCE validation to authorization codes issued through certain OpenID Connect hybrid response modes. An attacker who intercepts an affected code may obtain tokens for a public client when that code was issued through one of those flows.",
  "mitigation": "Upgrade OpenAM to version 16.1.3 or later. Until upgraded, disable affected OpenID Connect hybrid response modes where feasible and reduce the risk of authorization-code interception.",
  "vendor": "OpenIdentityPlatform",
  "product": "OpenAM",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 16.1.2"
      ],
      "ecosystem": "maven",
      "fixed_versions": [
        "16.1.3"
      ],
      "package_name": "org.openidentityplatform.openam:openam-oauth2",
      "purl": "pkg:maven/org.openidentityplatform.openam/openam-oauth2"
    }
  ],
  "cwes": [
    285
  ],
  "cvss_score": 7.6,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
  "epss_score": 0.002,
  "epss_percentile": 0.0877,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 60.9056894,
  "t0_at": "2026-10-03T12:14:43.643000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-03T12:14:43.643000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-03T12:14:43.643000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105119"
    }
  }
}