OpenAM prior to version 16.1.3 enforces PKCE (Proof Key for Code Exchange) only on OAuth2 authorization requests where the response_type parameter is exactly 'code'. However, for OpenID Connect hybrid flows that use response types such as 'code token', 'code id_token', or 'code token id_token', the issued authorization codes lack a bound PKCE challenge. This flaw allows an attacker who intercepts such an authorization code to redeem it for tokens from a public client by providing any non-empty code_verifier, bypassing the intended PKCE protection.

This vulnerability allows an attacker who intercepts an authorization code from OpenID Connect hybrid flows to redeem it for tokens without needing the legitimate PKCE code verifier. This can lead to unauthorized token issuance for public clients, potentially enabling unauthorized access to protected resources. The CVSS 4.0 score is 7.6 (high severity), reflecting network attack vector, high impact on confidentiality and integrity, and partial user interaction required.

A fix is available in OpenAM version 16.1.3 and later. Users should upgrade to version 16.1.3 or newer to ensure PKCE enforcement applies correctly to all OAuth2 and OpenID Connect flows, including hybrid flows. No other mitigation guidance is provided in the input data.