# CVE-2026-46560: OpenAM Authentication Bypass via RADIUS Spoofing

Status: published. Published: 2026-10-30. Updated: 2026-11-05.

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `RADIUS` authentication module opens an unconnected datagram socket and trusts the first UDP datagram received on the client source port. The receive path does not verify the source IP and port, match the response identifier to the outstanding request, or verify the RFC 2865 `Response Authenticator`; the RFC 2869 `Message-Authenticator` is neither sent nor required. Any non-Reject/non-Challenge packet is treated as success. On a deployment with a `RADIUS` module instance enabled on a login chain, an unauthenticated network attacker can race the real server on-path or spray forged `Access-Accept` packets off-path and obtain a session for any `RADIUS`-mapped username without knowing the shared secret. Unlike CVE-2024-3596, exploitation requires no MD5 chosen-prefix forgery because no response authenticator is checked. The resulting session carries the impersonated principal's privileges. This issue is fixed in version 16.1.1.

## Remediation

- fix: org.openidentityplatform.openam:openam-radius (Maven): OSV reports a fixed version 16.1.1. Check the advisory for supported release branches. (source: OSV GHSA-386j-6m86-78f9) — https://github.com/advisories/GHSA-386j-6m86-78f9

## Affected products and versions

- OpenIdentityPlatform / OpenAM: < 16.1.1 (affected). Source: CNA: GitHub_M
-  / org.openidentityplatform.openam:openam-radius (org.openidentityplatform.openam:openam-radius): 14.5.2 (affected, Maven); 14.5.3 (affected, Maven); 14.5.4 (affected, Maven); 14.6.1 (affected, Maven); 14.6.2 (affected, Maven); 14.6.3 (affected, Maven); 14.6.4 (affected, Maven); 14.6.5 (affected, Maven); 14.6.6 (affected, Maven); 14.7.0 (affected, Maven); 14.7.1 (affected, Maven); 14.7.2 (affected, Maven); 14.7.3 (affected, Maven); 14.7.4 (affected, Maven); 14.8.1 (affected, Maven); 14.8.2 (affected, Maven); 14.8.3 (affected, Maven); 14.8.4 (affected, Maven); 15.0.0 (affected, Maven); 15.0.1 (affected, Maven); 15.0.2 (affected, Maven); 15.0.3 (affected, Maven); 15.0.4 (affected, Maven); 15.1.0 (affected, Maven); 15.1.1 (affected, Maven); 15.1.2 (affected, Maven); 15.1.3 (affected, Maven); 15.1.4 (affected, Maven); 15.1.5 (affected, Maven); 15.1.6 (affected, Maven); 15.2.0 (affected, Maven); 15.2.1 (affected, Maven); 15.2.2 (affected, Maven); 16.0.1 (affected, Maven); 16.0.2 (affected, Maven); 16.0.3 (affected, Maven); 16.0.4 (affected, Maven); 16.0.5 (affected, Maven); 16.0.6 (affected, Maven); 16.1.0 (affected, Maven); Ecosystem version events: introduced 0; fixed 16.1.1. Source: OSV GHSA-386j-6m86-78f9

## Severity and prioritization

- CVSS 3.1: 7.5 (high); CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H; source: CNA: GitHub_M

- CISA KEV: No listing in collected sources

- EPSS: 0.19% as of 2026-11-04; percentile 8.24%

- SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-347

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-386j-6m86-78f9 (CNA: GitHub_M; x_refsource_CONFIRM)

- https://github.com/OpenIdentityPlatform/OpenAM/commit/5a0c10eccd1d45aaeb5575bbe7f7b1d01964a775 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/advisories/GHSA-386j-6m86-78f9 (OSV / GitHub Security Advisories; advisory)

- https://osv.dev/vulnerability/GHSA-386j-6m86-78f9 (OSV / GitHub Security Advisories; osv)

## Provenance

- CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2026-46560; retrieved 2026-11-05; source updated 2026-11-05

- OSV / GitHub Security Advisories: https://osv.dev/vulnerability/GHSA-386j-6m86-78f9; retrieved 2026-11-05; source updated 2026-10-28

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-46560; retrieved 2026-11-05; source updated Not reported

Revision: 98f5db57ee7ec3d27c80c6cf7d9a65749218d5967fcbda2f2604feca2ce49b82

Canonical: https://y2.dev/cve/CVE-2026-46560

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.