CVE-2025-64099

Open Access Management (OpenAM) is an access management solution. In versions prior to 16.0.0, if the "claims_parameter_supported" parameter is activated, it is possible, thanks to the "oidc-claims-extension.groovy" script, to inject the value of one's choice into a claim contained in the id_token or in the user_info. In the request of an authorize function, a claims parameter containing a JSON file can be injected. This JSON file allows attackers to customize the claims returned by the "id_token" and "user_info" files. This allows for a very wide range of vulnerabilities depending on how clients use claims. For example, if some clients rely on an email field to identify a user, an attacker can choose the email address they want, and therefore assume any identity they choose. Version 16.0.0 fixes the issue.

• CWE-74

• https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-39hr-239p-fhqc

Published

Nov 12, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-64093Remote Code Execution vulnerability that allows unauthentica…9.8
• CVE-2025-64094DNN (formerly DotNetNuke) is an open-source web content mana…5.4
• CVE-2025-64095DNN (formerly DotNetNuke) is an open-source web content mana…9.8
• CVE-2025-64096CryptoLib provides a software-only solution using the CCSDS …8.8
• CVE-2025-64097NervesHub is a web service that allows users to manage over-…9.8
• CVE-2025-64098Fast DDS is a C++ implementation of the DDS (Data Distributi…5.9
• CVE-2025-6410A vulnerability was found in PHPGurukul Art Gallery Manageme…8.8
• CVE-2025-64100CKAN is an open-source DMS (data management system) for powe…6.1
• CVE-2025-64101Zitadel is open-source identity infrastructure software. Pri…8.8
• CVE-2025-64102Zitadel is open-source identity infrastructure software. Pri…9.8
• CVE-2025-64103Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only requi…9.8
• CVE-2025-64104LangGraph SQLite Checkpoint is an implementation of LangGrap…7.3