Threats tagged 'ghsa-2j6x-v2h7-284v'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
High	7.6	CVE-2026-123542OpenAM before 16.1.4 fails to enforce PKCE in the OAuth 2.0 device authorization flow, never validating the code High7.62026-11-08GCVE DatabaseCVE-2026-123542 OpenAM versions prior to 16.1.4 do not enforce PKCE in the OAuth 2.0 device authorization flow, failing to validate the code verifier when exchanging device codes for tokens. This allows attackers who obtain an approved device code from client logs or shared device storage to redeem it for access and ID tokens, potentially impersonating the user. Report on CVE-2026-123542 Vulnerability CWE-358 #ghsa-2j6x-v2h7-284v	GCVE Database	2026-11-08

Page 1 of 1