GHSA-pw99-8h4m-p3gm: OpenAM before 16.1.4 Incomplete Attribute Encoding in SAML 1.x Form POST

Published Nov 8, 2026

Updated

OpenAM before 16.1.4 contains an incomplete output encoding vulnerability that allows a SAML 1.x identity provider to alter attribute values by injecting unencoded content into the service provider auto-submitted form. Attackers controlling a trusted identity provider can craft assertion attribute names or values that reach the target application in modified form, undermining the integrity of received attributes.

Event History

Nov 8, 2026

CVE Published

via OSV·01:37 AM

Data Sourced

via OSV·01:37 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is realistically exposed to this issue?

Service providers that consume SAML 1.x assertions from a trusted identity provider are exposed if the identity provider can supply attacker-controlled assertion attribute names or values. The described attack requires control of a trusted identity provider.

What does an attacker need to exploit it?

An attacker needs to control a trusted SAML 1.x identity provider and craft assertion attribute names or values containing unencoded content. That content can reach the service provider's auto-submitted form and alter the attribute values received by the target application.

Which OpenAM versions are affected?

OpenAM versions before 16.1.4 are affected. The provided data does not identify affected configurations beyond the SAML 1.x identity provider and service provider flow.

GHSA-pw99-8h4m-p3gm: OpenAM before 16.1.4 Incomplete Attribute Encoding in SAML 1.x Form POST

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit it?

Which OpenAM versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit it?

Which OpenAM versions are affected?