What is GHSA-2j6x-v2h7-284v?

GHSA-2j6x-v2h7-284v is a security advisory published by GitHub Security Advisories with High severity. OpenAM before 16.1.4 fails to enforce PKCE in the OAuth 2.0 device authorization flow, never...

Which CVE IDs does GHSA-2j6x-v2h7-284v cover?

GHSA-2j6x-v2h7-284v covers the following CVE IDs: CVE-2026-123542. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2j6x-v2h7-284v?

GHSA-2j6x-v2h7-284v has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

GHSA-2j6x-v2h7-284vHighCVSS 6.8

OpenAM before 16.1.4 fails to enforce PKCE in the OAuth 2.0 device authorization flow, never...

Vendor

GitHub Security Advisories

Published

November 8, 2026

Last Modified

November 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-123542 →

📋 Description

OpenAM before 16.1.4 fails to enforce PKCE in the OAuth 2.0 device authorization flow, never validating the code verifier when device codes are exchanged for tokens. Attackers who obtain an approved device code from client logs or shared device storage can redeem it for access and ID tokens to impersonate the user.

🔗 References (4)

https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-h93p-35jm-rj83
https://nvd.nist.gov/vuln/detail/CVE-2026-123542
https://www.vulncheck.com/advisories/openam-before-16.1.4-pkce-bypass-in-oauth-2.0-device-authorization-flow
https://github.com/advisories/GHSA-2j6x-v2h7-284v