Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the private_key_jwt client authentication path uses ClientJwksResolverCache without reliably binding a cached jwks_uri resolver and verified assertion to the expected clientID in ClientCredentialsReader. An attacker controlling any registered client with published keys, including one obtained through open dynamic registration when enabled, can authenticate as another client whose keys are exposed through jwks_uri and mint tokens in that client's name across realms in the same OpenAM process. This issue is fixed in version 16.1.1.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the private_key_jwt     client authentication path uses ClientJwksResolverCache without reliably binding a cached jwks_uri     resolver and verified assertion to the expected clientID in ClientCredentialsReader. An attacker     controlling any registered client with published keys, including one obtained through open dynamic     registration when enabled, can authenticate as another client whose keys are exposed through jwks_uri and     mint tokens in that client's name across realms in the same OpenAM process. This issue is fixed in version     16.1.1. (CVE-2026-47426)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the private_key_jwt
    client authentication path uses ClientJwksResolverCache without reliably binding a cached jwks_uri
    resolver and verified assertion to the expected clientID in ClientCredentialsReader. An attacker
    controlling any registered client with published keys, including one obtained through open dynamic
    registration when enabled, can authenticate as another client whose keys are exposed through jwks_uri and
    mint tokens in that client's name across realms in the same OpenAM process. This issue is fixed in version
    16.1.1. (CVE-2026-47426)

ID	Name	Product	Family	Type	Severity
346391	Linux Distros Unpatched Vulnerability : CVE-2026-47426	Nessus	Misc.	Local	high
444112	SCA: security update for org.openidentityplatform.openam:openam-oauth2 (GHSA-f2cx-463q-7m2c)	Tenable Cloud Security	SCA Checks	Local	high
444112	SCA: security update for org.openidentityplatform.openam:openam-oauth2 (GHSA-f2cx-463q-7m2c)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-47426

high

Tenable Plugins

high

high

high