GitHub Advisoryadvisory · Maven

GHSA-39hr-239p-fhqc OpenAM: Using arbitrary OIDC requested claims values in id_token and user_info is allowed

HIGH Published 2025-11-12 Modified 2025-11-15 Official page ↗
Aliases
CVE-2025-64099
Ecosystem
Maven
Packages
org.openidentityplatform.openam:openam-oauth2
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-74, CWE-94
Reviewed
2025-11-12

Affected packages

• Maven org.openidentityplatform.openam:openam-oauth2: < 16.0.3 → fixed in 16.0.3

Description

Summary If the "claims_parameter_supported" parameter is activated, it is possible through the "oidc-claims-extension.groovy" script, to inject the value of choice into a claim contained in the id_token or in the user_info. Authorization function requests do not prevent a claims parameter containing a JSON file to be injected. This JSON file allows users to customize claims returned by the "id_token" and "user_info" files. This allows for a very wide range of vulnerabilities depending on how clients use claims. For example, if some clients rely on an email field to identify a user, users can choose to entera any email address, and therefore assume any chosen identity.

Related

Alias · CVE (1)

  • CVE-2025-64099 Open Access Management (OpenAM) is an access management solution. vulnerability

Weakness · CWE (2)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-94 Improper Control of Generation of Code weakness

References