Description
OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device authorization flow that allows attackers to approve device codes when consent is skipped for implied-consent clients. Attackers can start a device authorization and lure a logged-in user to a crafted page, obtaining access and ID tokens to call APIs as that user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenIdentityPlatform | OpenAM | 14.5.1 – < 16.1.4 | 16.1.4 |
References
- GitHub Security Advisory (GHSA-545c-rm35-2jj2) vendor-advisory
- VulnCheck Advisory: OpenAM 14.5.1 before 16.1.4 CSRF in OAuth 2.0 Device Flow third-party-advisory