Critical 9.8

OpenAM before 16.1.4 SAML Authentication Bypass via Unsigned Assertions

CVE-2026-123550 First seen on SecPulse Nov 8, 10:37

Affected packages

Ecosystem	Package	Affected → Fixed	Fixed
OpenIdentityPlatform	OpenIdentityPlatformOpenAM	< 16.1.4→ 16.1.4	16.1.4

Original description The description as published by the source.

OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts unsigned assertions on the ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false. Unauthenticated remote attackers can submit forged assertions to obtain sessions as any mapped user, including administrators, and hijack single sign-on to dependent applications.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Critical 9.8; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4: Critical 9.3; CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Published: Nov 8, 2026
First seen on SecPulse: Nov 8, 10:37
GHSA: GHSA-3j2f-qhrc-rjfj
CWE: CWE-290

NVD GitHub Advisory

Tags(click for explanation)

Attack Types

Authentication Bypass

CWE

CWE-290

All

Openidentityplatform Openam

Detection sources

OSV.dev (Open Source Vulnerabilities)Nov 9, 11:47
NIST National Vulnerability Database07:13
GitHub Security Advisories (Global)Nov 8, 12:30
CVE.org (CVE Program・cvelistV5)Nov 9, 22:58