Threats tagged 'ghsa-f3q2-cw3w-jw26'

OpenAM versions prior to 16.1.4 contain a critical vulnerability where the Valid Creation Attributes list is not enforced during self-registration. This flaw allows anonymous attackers to set restricted attributes, including group membership, enabling them to join administrative groups and gain full administrative control of the OpenAM system.