Description
OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose response_type is exactly code, so codes issued through OpenID Connect hybrid flows (code token, code id_token, code token id_token) carry no bound challenge. An attacker who intercepts such a code can redeem it for a public client's tokens with any non-empty code_verifier.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenIdentityPlatform | OpenAM | < 16.1.3 | 16.1.3 |
References
- GitHub Security Advisory (GHSA-5p2f-7vcr-6vfh) vendor-advisory
- VulnCheck Advisory: OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows third-party-advisory