CVE-2026-123542

OpenAM versions before 16.1.4 are vulnerable to a PKCE Bypass in the OAuth 2.0 Device Authorization Flow . The software fails to validate the code verifier when exchanging device codes for tokens. An attacker who retrieves an approved device code from client logs or shared device storage can rede...