Identity Spoofing Vulnerability in Open Access Management by OpenIdentityPlatform

CVE-2025-64099

What is CVE-2025-64099?

Open Access Management (OpenAM) contains a vulnerability that allows attackers to exploit the 'claims_parameter_supported' feature in versions before 16.0.0. By utilizing the 'oidc-claims-extension.groovy' script, attackers can inject arbitrary JSON values into either the id_token or user_info claims. This manipulation enables them to craft custom claims that can impersonate any user, potentially compromising the integrity of user identification mechanisms. Clients that depend on specific user attributes, such as email addresses, are particularly vulnerable as attackers can assume any identity they choose. Version 16.0.0 addresses this security issue.

References