Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a code_verifier only when the realm-wide codeVerifierEnforced setting is enabled, even when an authorization code stores a code_challenge. Because that setting is disabled by default, an attacker who intercepts a PKCE-protected authorization code can omit code_verifier and redeem the code, while an explicitly incorrect verifier is rejected. Public clients are directly affected, and confidential-client exploitation additionally requires client authentication material or another redemption context. This issue is fixed in version 16.1.1.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1,     AuthorizationCodeGrantTypeHandler requires a code_verifier only when the realm-wide codeVerifierEnforced     setting is enabled, even when an authorization code stores a code_challenge. Because that setting is     disabled by default, an attacker who intercepts a PKCE-protected authorization code can omit code_verifier     and redeem the code, while an explicitly incorrect verifier is rejected. Public clients are directly     affected, and confidential-client exploitation additionally requires client authentication material or     another redemption context. This issue is fixed in version 16.1.1. (CVE-2026-48717)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1,
    AuthorizationCodeGrantTypeHandler requires a code_verifier only when the realm-wide codeVerifierEnforced
    setting is enabled, even when an authorization code stores a code_challenge. Because that setting is
    disabled by default, an attacker who intercepts a PKCE-protected authorization code can omit code_verifier
    and redeem the code, while an explicitly incorrect verifier is rejected. Public clients are directly
    affected, and confidential-client exploitation additionally requires client authentication material or
    another redemption context. This issue is fixed in version 16.1.1. (CVE-2026-48717)

ID	Name	Product	Family	Type	Severity
346383	Linux Distros Unpatched Vulnerability : CVE-2026-48717	Nessus	Misc.	Local	critical
444111	SCA: security update for org.openidentityplatform.openam:openam-oauth2 (GHSA-4v2w-2wqp-mc85)	Tenable Cloud Security	SCA Checks	Local	critical
444111	SCA: security update for org.openidentityplatform.openam:openam-oauth2 (GHSA-4v2w-2wqp-mc85)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-48717

critical

Tenable Plugins

critical

critical

critical