The RADIUS authentication module in OpenAM versions before 16.1.1 opens an unconnected UDP socket and trusts the first datagram it receives without validating the source IP, port, response identifier, or the RFC 2865 Response Authenticator. Because any non‑Reject/non‑Challenge packet, including forged Access‑Accept messages, is treated as a success, an attacker can create an authenticated session for any RADIUS‑mapped username without knowing the shared secret. The resulting session carries the impersonated principal’s privileges, allowing unauthorized access under the guise of that user.

Affected deployments are systems using OpenIdentityPlatform OpenAM with a RADIUS authentication module enabled on a login chain, running any version prior to 16.1.1. Versions 16.1.1 and newer contain a fix that validates RADIUS responses properly and does not accept unverified packets.

The CVSS score of 7.5 indicates high severity. The vulnerability can be exploited remotely by sending forged UDP packets to the OpenAM RADIUS port, requiring only basic network connectivity to the service. Because it does not require shared secrets or complex cryptographic operations, the attack path is straightforward. The resulting authenticated session gives the attacker the privileges associated with the impersonated user. While the EPSS score is not available, the simplicity of the exploit and the high severity suggest a meaningful risk.