OpenAM Community Edition through version 16.0.6 contains a vulnerability in its RADIUS authentication module that allows unauthenticated attackers to bypass authentication by spoofing Access-Accept responses. This flaw arises from improper verification of cryptographic signatures, enabling attackers to obtain valid OpenAM sessions for any RADIUS username without knowing the shared secret. The issue was patched in version 16.1.1.