{"id":"CVE-2025-64099","aliases":[],"url":"https://o3.security/vulnerability/CVE-2025-64099","summary":"Open Access Management (OpenAM) is an access management solution. In versions prior to 16.0.0, if the \"claims_parameter_supported\" parameter is activated, it is possible, thanks to…","details":"Open Access Management (OpenAM) is an access management solution. In versions prior to 16.0.0, if the \"claims_parameter_supported\" parameter is activated, it is possible, thanks to the \"oidc-claims-extension.groovy\" script, to inject the value of one's choice into a claim contained in the id_token or in the user_info. In the request of an authorize function, a claims parameter containing a JSON file can be injected. This JSON file allows attackers to customize the claims returned by the \"id_token\" and \"user_info\" files. This allows for a very wide range of vulnerabilities depending on how clients use claims. For example, if some clients rely on an email field to identify a user, an attacker can choose the email address they want, and therefore assume any identity they choose. Version 16.0.0 fixes the issue.","published":"2025-11-12T19:15:38.087","modified":"2026-06-17T09:53:49.447","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-39hr-239p-fhqc"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-06-17T09:53:49.447"}}