CVE-2026-105117 — OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions
OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control notification email wording via the forgotPassword and reg…
Published: 2026-10-03 · CVSS: 5.3 · CVSS 4.0
OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control notification email wording via the forgotPassword and register actions on /json/{realm}/users. Attackers can supply subject and message fields to send phishing mail from the organisation's configured From address, or abuse register as a relay to arbitrary recipients.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7