CVE-2026-105119

OpenAM versions prior to 16.1.3 are vulnerable to a PKCE enforcement bypass via OAuth 2.0 hybrid flows . The root cause is that the software only applies Proof Key for Code Exchange (PKCE) enforcement to authorization requests where the response_type is exactly code. Consequently, codes issued th...