https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 23:19:05 +0000 https://cve.radiocsirt.org/vuln/cve-2025-64099 <p><strong>Affected:</strong> OpenIdentityPlatform OpenAM</p> <p>Open Access Management (OpenAM) is an access management solution. In versions prior to 16.0.0, if the &#34;claims_parameter_supported&#34; parameter is activated, it is possible, thanks to the &#34;oidc-claims-extension.groovy&#34; script, to inject the value of one&#39;s choice into a claim contained in the id_token or in the user_info. In the request of an authorize function, a claims parameter containing a JSON file can be injected. This JSON file allows attackers to customize the claims returned by the &#34;id_token&#34; and &#34;user_info&#34; files. This allows for a very wide range of vulnerabilities depending on how clients use claims. For example, if some clients rely on an email field to identify a user, an attacker can choose the email address they want, and therefore assume any identity they choose. Version 16.0.0 fixes the issue.</p> <p><strong>Affected:</strong> OpenIdentityPlatform OpenAM</p> <p>Open Access Management (OpenAM) is an access management solution. In versions prior to 16.0.0, if the &#34;claims_parameter_supported&#34; parameter is activated, it is possible, thanks to the &#34;oidc-claims-extension.groovy&#34; script, to inject the value of one&#39;s choice into a claim contained in the id_token or in the user_info. In the request of an authorize function, a claims parameter containing a JSON file can be injected. This JSON file allows attackers to customize the claims returned by the &#34;id_token&#34; and &#34;user_info&#34; files. This allows for a very wide range of vulnerabilities depending on how clients use claims. For example, if some clients rely on an email field to identify a user, an attacker can choose the email address they want, and therefore assume any identity they choose. Version 16.0.0 fixes the issue.</p> https://cve.radiocsirt.org/vuln/cve-2025-64099