PT-2026-139830

OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, allowing anonymous attackers to set restricted attributes including group membership. Attackers can register through the legacy self-service REST endpoint or User Self-Service flow to join...

CVE-2026-123549: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, allowing anonymous…

OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, allowing anonymous attackers to set restricted attributes including group membership. Attackers can register through the legacy self-service REST endpoint or User Self-Service flow to join...