CVE-2026-105117 describes an improper input validation vulnerability in OpenIdentityPlatform's OpenAM product prior to version 16.1.3. The flaw exists in the handling of email content in the forgotPassword and register actions under the /json/{realm}/users endpoint. Unauthenticated attackers can supply arbitrary subject and message fields, enabling them to send phishing emails appearing to originate from the organisation's configured email address or relay emails to arbitrary recipients.

The vulnerability allows unauthenticated attackers to send crafted emails that appear to come from the legitimate organisation, facilitating phishing attacks. This can lead to reputational damage and potential compromise of recipients who trust the emails. The ability to relay emails to arbitrary recipients may also increase spam or phishing distribution.

A fixed version, 16.1.3, is available that addresses this vulnerability. Users should upgrade to OpenAM 16.1.3 or later to remediate this issue. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes.