Exploit for CVE-2021-29156

kitploit · 2026-08-26

Description

Hidden OAuth attack vectors in OpenAM, fixed in version 13.0.0.

Affected Forgerock Openam versions

Forgerock Openam< 13.5.1

All known vulnerabilities by product

Forgerock Openam

CVSS 7.5 for CVE-2021-29156

7.5

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:NONE

Availability:NONE

EPSS Score

76.4%higher than 99.5% of all CVEs

Updated 2026-08-29

CVE Information

References

https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/13.0.0

Exploit Details

Modified:2026-08-26 07:35

Last Seen:2026-08-26 08:59

Reporter:KitPloit

Tags

OpenAMOAuthProof of ConceptHidden attack vectorsIdentity platform

Other exploits for CVE-2021-29156

2026-08-28 KitPloitKITPLOIT

Exploit for Injection in Forgerock Openam

2022-10-07 5amuGITHUB

OpenAM 13.0 - LDAP Injection Exploit

2021-11-03 Charlton TrezevantZDTPython

OpenAM 13.0 - LDAP Injection

2021-11-03 Charlton TrezevantEXPLOITDBPython

Exploit for Injection in Forgerock Openam

2021-11-03 guidepointsecurityGITHUB

Exploit Code

MARKDOWN18 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-5AMU-CVE-2021-29156
# CVE-2021-29156 richtig gemacht

Dieser Proof of Concept wurde umgesetzt, weil der andere öffentlich verfügbare PoC defekt ist ✨

## Installation

root@kitploit:~
    
    
    go install github.com/5amu/CVE-2021-29156@latest
    

## Referenzen

  * https://nvd.nist.gov/vuln/detail/CVE-2021-29156
  * https://portswigger.net/research/hidden-oauth-attack-vectors
  * https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/13.0.0