CVE-2026-123550: Security vulnerability

Published Nov 8, 2026

Updated

OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts unsigned assertions on the ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false. Unauthenticated remote attackers can submit forged assertions to obtain sessions as any mapped user, including administrators, and hijack single sign-on to dependent applications.

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

OpenAM versions before 16.1.4 are exposed when they use the SAML v2.0 service provider with the ECP (PAOS) or HTTP-Artifact binding and WantAssertionsSigned is set to false.

What does an attacker need to exploit it?

An attacker does not need to authenticate. They need to submit a forged unsigned SAML assertion through an affected binding for a user that OpenAM maps, potentially including an administrator.

Are default configurations affected?

The available information identifies the affected condition as WantAssertionsSigned being false, but does not state whether this is the default setting.

What is the impact if exploitation succeeds?

An attacker can obtain an OpenAM session as any mapped user, including administrators, and can hijack single sign-on access to dependent applications.

What can be done before upgrading?

Set WantAssertionsSigned to true for the affected SAML v2.0 service-provider configuration and avoid accepting unsigned assertions on the ECP (PAOS) and HTTP-Artifact bindings.

CVE-2026-123550: Security vulnerability

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

Are default configurations affected?

What is the impact if exploitation succeeds?

What can be done before upgrading?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

Are default configurations affected?

What is the impact if exploitation succeeds?

What can be done before upgrading?