RADIUS Authentication Module Vulnerability in Open Access Management by OpenIdentityPlatform

CVE-2026-46560

What is CVE-2026-46560?

The RADIUS authentication module in Open Access Management (OpenAM) prior to version 16.1.1 permits unauthenticated network attackers to exploit vulnerabilities by sending forged packets. The module trusts the first received UDP datagram without proper verification of the source IP and port, or matching the response to the outstanding request. As a result, an attacker can gain unauthorized sessions for any RADIUS-mapped username, effectively impersonating any principal within the system. This issue has been rectified in version 16.1.1, highlighting the importance of timely updates to mitigate such vulnerabilities.

References