CVE-2026-105119 OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows

OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose responsetype is exactly code, so codes issued through OpenID Connect hybrid flows code token, code idtoken, code token idtoken carry no bound challenge. An attacker who intercepts such a code ca...

CVE-2026-105119 OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows

OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose responsetype is exactly code, so codes issued through OpenID Connect hybrid flows code token, code idtoken, code token idtoken carry no bound challenge. An attacker who intercepts such a code ca...

CVE-2026-105119 OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows

OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose responsetype is exactly code, so codes issued through OpenID Connect hybrid flows code token, code idtoken, code token idtoken carry no bound challenge. An attacker who intercepts such a code ca...

CVE-2026-105119

OpenAM versions prior to 16.1.3 are vulnerable to a PKCE enforcement bypass via OAuth 2.0 hybrid flows . The root cause is that the software only applies Proof Key for Code Exchange (PKCE) enforcement to authorization requests where the response_type is exactly code. Consequently, codes issued th...

PT-2026-104580

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description The OAuth2 Provider PKCE enforcement is only applied to authorization requests where the response type is exactly code. Consequently, codes issued via OpenID Connect hybrid flows such as code token,...