Advisory · CVE-2026-123549
OpenAM self-registration flaw lets anonymous users grant themselves admin rights
OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, letting anonymous attackers set restricted attributes including group membership and join administrative groups, rated critical at CVSS 9.8; fixed in 16.1.4.
- Vendor
- OpenIdentityPlatform
- Product
- OpenAM
- Identifier / CWE
- CVE-2026-123549
CWE-269 - Action timing
- Immediate
Explain it like I’m five
OpenAM lets new users sign themselves up, and it is supposed to block them from picking protected settings like which groups they join. A bug skips that check, so a stranger can sign up straight into the admin group.
- 01Attacker opens self-registration
An anonymous user reaches the legacy self-service REST endpoint or the User Self-Service flow.
- 02Restricted attribute supplied
The registration request includes a protected attribute such as group membership.
- 03Check skipped
OpenAM fails to enforce the Valid Creation Attributes list on the request.
- 04Admin group joined
The new account lands in an administrative group.
- 05Full control
The attacker administers the identity platform and everything behind it.
What happened
OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration. An anonymous attacker can register through the legacy self-service REST endpoint or the User Self-Service flow and set restricted attributes, including group membership, joining administrative groups and gaining full administrative control of OpenAM. The record rates it critical at CVSS 9.8 under version 3.1, with network attack vector, low complexity, no privileges required, and no user interaction.
This is an identity platform flaw, so the blast radius is every application and service that trusts OpenAM for authentication and authorization. The flaw is fixed in OpenAM 16.1.4.
What to do
- Inventory OpenAM deployments and record each version.
- Upgrade to OpenAM 16.1.4 or later.
- Until upgraded, restrict access to self-registration endpoints where the deployment allows it.
- Audit group memberships, especially administrative groups, for accounts created through self-registration.
- Review registration logs for requests that set restricted attributes.
- Revoke any administrative group membership that cannot be accounted for and rotate credentials for affected accounts.
- Verify the deployed version after updating.
Management note
Anonymous-to-admin in the identity platform is as bad as it sounds. Self-registration is a public front door, so check who walked through it before assuming the fix closes the incident.