External risk intelligence

OpenAM SOAP Receiver Unauthenticated Persistent Entry Writes

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-45052

OpenAM is an access management solution designed to handle identity and authentication traffic. As an identity provider or gateway, its services—including SOAP and discovery endpoints—are typically exposed to the network to facilitate authentication and service routing for users and applications, making these interfaces naturally public-facing or accessible to external service consumers by design.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in the OpenAM access management solution that could allow unauthenticated remote requests to manipulate persistent data. The issue involves bypassing standard access controls, potentially enabling the modification of service-routing or security records, which could impact how users and applications authenticate and access resources. The primary concern is confirming if your OpenAM deployments are exposed and relevant to this vulnerability.

Unauthenticated access can alter critical system data.
Affects access management, impacting user and application security.
Confirm relevance and exposure to this access control flaw.

Attack Path

How an attacker could exploit the issue

An attacker could begin by sending unauthenticated requests to the OpenAM Liberty Web Services SOAP receiver. This allows them to write malicious entries into a user's discovery store and the shared discovery branch, bypassing standard access controls. If the vulnerable system consumes this manipulated discovery data, it could lead to altered service routing or security mechanisms.

Unauthenticated network access required.
SOAP receiver writes to discovery store.
Risk of manipulated service routing.

Live Threat

Current exploitation, exposure, and threat context

The OpenAM Liberty Web Services SOAP receiver can permit unauthenticated remote requests to write persistent entries into a user's Liberty Discovery store and the shared root-realm Discovery branch. When supported by the advisory, this could affect service-routing or security-mechanism records, potentially leading to manipulated configurations.

Discovery data and service routing records.
Unauthenticated remote write access.
Manipulated service routing or security.

Operational Fix

Recommended remediation, mitigation, and detection steps

The OpenAM access management solution is susceptible to unauthenticated remote requests that can manipulate discovery data. In typical deployments, the platform or infrastructure teams are responsible for managing OpenAM, while the security or network teams would oversee its exposure and access controls. The first practical step involves identifying all OpenAM instances, confirming their network reachability and business criticality, and then assigning ownership for remediation planning based on the assessed risk.

Platform or infrastructure teams own resolution.
Verify external reachability and criticality.
Plan vendor coordination and upgrade.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpenAM?

OpenAM is an identity and access management solution used to handle authentication, authorization, and service routing for users and applications. It acts as a central hub for identity traffic, often managing discovery services that allow different components to locate and communicate with each other securely within an enterprise environment.

What is the nature of the CVE-2026-45052 weakness?

This vulnerability is classified as CWE-285, which involves improper authorization. In this specific case, the software fails to correctly check or enforce permissions when processing requests. This flaw allows an unauthorized actor to bypass standard identity access controls, effectively ignoring the protections that should prevent them from modifying sensitive internal data.

How does an attacker trigger this vulnerability?

An attacker triggers this issue by sending unauthenticated requests directly to the Liberty Web Services SOAP receiver within OpenAM. By targeting these specific endpoints, the requester can write persistent entries into the discovery store. It is important to note that sending requests to other, non-SOAP interfaces of the application does not trigger this specific write-access bug.

Is my deployment at risk from CVE-2026-45052?

Halo Surface Signal indicates that OpenAM services, including SOAP and discovery endpoints, are often intentionally exposed to the network to facilitate service routing. If your instance is reachable over the network—especially if it is internet-facing—the risk is elevated because the vulnerability does not require any credentials or prior authentication to exploit the underlying flaw.

What should I do if I am running OpenAM?

First, identify all active OpenAM instances in your infrastructure and confirm their current version. If you are running any version prior to 16.1.1, you are affected. Your immediate operational priority is to plan and execute an upgrade to version 16.1.1 or later, as this is the documented fix provided by the vendor to address the authorization bypass.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.