GHSA-3j2f-qhrc-rjfj: OpenAM before 16.1.4 SAML Authentication Bypass via Unsigned Assertions

Published Nov 8, 2026

Updated

OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts unsigned assertions on the ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false. Unauthenticated remote attackers can submit forged assertions to obtain sessions as any mapped user, including administrators, and hijack single sign-on to dependent applications.

Event History

Nov 8, 2026

CVE Published

via OSV·01:37 AM

Data Sourced

via OSV·01:37 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

OpenAM deployments before 16.1.4 are exposed when they use the SAML v2.0 service provider with the ECP (PAOS) or HTTP-Artifact binding and WantAssertionsSigned is set to false.

What does an attacker need to exploit it?

The attacker can be unauthenticated and remote. Exploitation requires submitting a forged unsigned SAML assertion that maps to a target user account.

What is the impact of successful exploitation?

An attacker can obtain a session as any mapped user, including an administrator. This can also allow hijacking single sign-on to applications that depend on OpenAM.

GHSA-3j2f-qhrc-rjfj: OpenAM before 16.1.4 SAML Authentication Bypass via Unsigned Assertions

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?