Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth2 authentication module updates an existing local account with profile attributes that can include userPassword and inetUserStatus, rewriting the password to the username and reactivating disabled accounts. The missing OAuth.removeRestrictedAccountUpdateAttributes filtering permits these credential and status fields to reach the account update. With account creation enabled, repeated OAuth login causes the default ldapService chain to accept the username as both identifier and password, allowing an unauthenticated attacker to take over the local account without interacting with the identity provider. The rewrite can be denied for usernames shorter than the configured minimum password length. This issue is fixed in version 16.1.1.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth2     authentication module updates an existing local account with profile attributes that can include     userPassword and inetUserStatus, rewriting the password to the username and reactivating disabled     accounts. The missing OAuth.removeRestrictedAccountUpdateAttributes filtering permits these credential and     status fields to reach the account update. With account creation enabled, repeated OAuth login causes the     default ldapService chain to accept the username as both identifier and password, allowing an     unauthenticated attacker to take over the local account without interacting with the identity provider.
    The rewrite can be denied for usernames shorter than the configured minimum password length. This issue is     fixed in version 16.1.1. (CVE-2026-46623)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth2
    authentication module updates an existing local account with profile attributes that can include
    userPassword and inetUserStatus, rewriting the password to the username and reactivating disabled
    accounts. The missing OAuth.removeRestrictedAccountUpdateAttributes filtering permits these credential and
    status fields to reach the account update. With account creation enabled, repeated OAuth login causes the
    default ldapService chain to accept the username as both identifier and password, allowing an
    unauthenticated attacker to take over the local account without interacting with the identity provider.
    The rewrite can be denied for usernames shorter than the configured minimum password length. This issue is
    fixed in version 16.1.1. (CVE-2026-46623)

ID	Name	Product	Family	Type	Severity
346353	Linux Distros Unpatched Vulnerability : CVE-2026-46623	Nessus	Misc.	Local	high
444008	SCA: security update for org.openidentityplatform.openam:openam-auth-oauth2 (GHSA-gf57-4mp6-m85x)	Tenable Cloud Security	SCA Checks	Local	high
444008	SCA: security update for org.openidentityplatform.openam:openam-auth-oauth2 (GHSA-gf57-4mp6-m85x)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-46623

high

Tenable Plugins

high

high

high