Vulnerability Description
Open Access Management (OpenAM) is an access management solution. In versions prior to 16.0.0, if the "claims_parameter_supported" parameter is activated, it is possible, thanks to the "oidc-claims-extension.groovy" script, to inject the value of one's choice into a claim contained in the id_token or in the user_info. In the request of an authorize function, a claims parameter containing a JSON file can be injected. This JSON file allows attackers to customize the claims returned by the "id_token" and "user_info" files. This allows for a very wide range of vulnerabilities depending on how clients use claims. For example, if some clients rely on an email field to identify a user, an attacker can choose the email address they want, and therefore assume any identity they choose. Version 16.0.0 fixes the issue.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2025-64099?
CVE-2025-64099 is a documented vulnerability. Open Access Management (OpenAM) is an access management solution. In versions prior to 16.0.0, if the "claims_parameter_supported" parameter is activated, it is possible, thanks to the "oidc-claims-ex...
How severe is CVE-2025-64099?
CVSS scoring is not yet available for CVE-2025-64099. Check NVD for updates.
Is there a patch for CVE-2025-64099?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.