GHSA-j56q-q3r3-hg7f: OpenAM before 16.1.4 SAML 1.x Signature Verification Issuer Impersonation

Published Nov 8, 2026

Updated

OpenAM before 16.1.4 does not verify that a signed SAML 1.x assertion or response was signed by the partner named as its issuer, accepting a signature from any certificate in OpenAM's keystore. An attacker holding such a private key, such as a trusted SAML 1.x partner, can forge assertions claiming another partner's issuer and sign in as that partner's users, including privileged ones.

Event History

Nov 8, 2026

CVE Published

via OSV·01:37 AM

Data Sourced

via OSV·01:37 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs the private key for any certificate trusted in the OpenAM keystore, such as a trusted SAML 1.x partner. They can then sign a forged assertion or response while claiming to be a different SAML 1.x partner.

What access could an attacker obtain?

The attacker can sign in as users of the impersonated partner, including privileged users. The impact depends on the accounts and privileges accepted for that partner.

Which deployments are affected?

OpenAM versions before 16.1.4 are affected when they process signed SAML 1.x assertions or responses and have certificates for multiple trusted parties in the keystore.

GHSA-j56q-q3r3-hg7f: OpenAM before 16.1.4 SAML 1.x Signature Verification Issuer Impersonation

Event History

Frequently Asked Questions

Who can exploit this issue?

What access could an attacker obtain?

Which deployments are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access could an attacker obtain?

Which deployments are affected?