【高危】openam-oauth2 安全更新（GHSA-f2cx-463q-7m2c）

安全情报快照 · 风险级别：高危 · CVE-2026-47426 · GHSA-f2cx-463q-7m2c

先看结论

openam-oauth2存在安全风险，<= 16.0.6 受影响，建议升级至 16.1.1。

影响范围

生态	组件	受影响版本	首个修复版本
maven	`org.openidentityplatform.openam:openam-oauth2`	<= 16.0.6	16.1.1

处置建议

优先将 org.openidentityplatform.openam:openam-oauth2 升级至 16.1.1 或更高版本；升级前请结合业务依赖完成兼容性验证。

上游技术详情（原文）

Summary

Description

An Improper Authentication (CWE-287) issue in OpenAM's OAuth2 private_key_jwt client authentication path allows any registered OAuth2 client to mint tokens in the name of any other client whose key is published via a jwks_uri, without knowing the victim's signing key. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1.

Impact

OpenAM Community Edition deployments through version 16.0.6 that have OAuth2 clients configured for private_key_jwt authentication with keys published via jwks_uri are potentially affected. An attacker holding any such client registration, their own, or one obtained through open dynamic client registration where enabled, can mint access tokens in any other such client's name, in any realm hosted by the OpenAM process.

Patch

This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.

来源与许可

本页自动同步 GitHub Advisory Database 的公开数据，并保留上游原文供核验；不宣称原创分析。数据许可：CC-BY-4.0。