Improper Authorization Affecting org.openidentityplatform.openam:openam-federation-library package, versions [,16.1.1)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Improper Authorization vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JAVA-ORGOPENIDENTITYPLATFORMOPENAM-17675291
- published29 Jun 2026
- disclosed24 Jun 2026
- creditwodzen
Introduced: 24 Jun 2026
NewCVE-2026-45052 (opens in a new tab)How to fix?
Upgrade org.openidentityplatform.openam:openam-federation-library to version 16.1.1 or higher.
Overview
Affected versions of this package are vulnerable to Improper Authorization via the Liberty Web Services SOAP receiver. An attacker can write persistent entries into any user's LDAP entry and the shared root-realm Discovery branch by sending anonymous requests to the relevant endpoint, bypassing normal identity-layer access controls. These writes are performed server-side with elevated internal privileges, potentially influencing service routing or security mechanism selection in deployments that consume Discovery data.