CVE-2026-46560 OpenAM Authentication Bypass via RADIUS Spoofing

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the RADIUS authentication module opens an unconnected datagram socket and trusts the first UDP datagram received on the client source port. The receive path does not verify the source IP and port, match the response...

CVE-2026-46560

In OpenAM Community Edition (through version 16.0.6 ), an Improper Verification of Cryptographic Signature (CWE-347) in the RADIUS authentication module allows unauthenticated network attackers to bypass authentication. The module opens an unconnected datagram socket and accepts the first UDP dat...