CVE-2026-105117CWE-20

CVE-2026-105117

Medium · published October 3, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
5.0
In the wild
Unconfirmed
What it is

OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control notification email wording via the forgotPassword and register actions on /json/{realm}/users. Attackers can supply subject and message fields to send phishing mail from the organisation's configured From address, or abuse register as a relay to arbitrary recipients.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00162 · 5.0th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-10-03T18:16Z
References (2)
https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-mw38-8gr7-c4x2 · [email protected]https://www.vulncheck.com/advisories/openam-before-16.1.3-email-content-injection-via-users-rest-self-service-actions · [email protected]
EPSS history
Timeline
  • 07 OCT 03:39Z
    EPSS moved — → 0%
    epss
  • 03 OCT 12:14Z
    OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions
    cvelistv5