CVE-2026-123538 · Other
NO FIX YET · SEE WHAT TO DO
OpenAM before 16.1.4 accepts a signed SAML 1.x assertion if it is signed by any certificate in its keystore, not necessarily the named issuer's. An attacker holding a trusted SAML 1.x partner's private key can forge assertions for another partner and sign in as that partner's users, including privileged ones.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organisations running OpenAM older than 16.1.4 that use SAML 1.x federation with partners. The risk depends on a partner holding a signing key, so deployments without SAML 1.x partners are likely less exposed. The sources do not say whether the issue is reachable without credentials beyond the partner-key requirement.
Not affected if no-saml-1x-partners, version-16.1.4-or-later
Who cares identity, openam, saml, sso
16.1.4 are affected.16.1.4 or later (per the sources).OpenAM before 16.1.4 does not verify that a signed SAML 1.x assertion or response was signed by the partner named as its issuer, accepting a signature from any certificate in OpenAM's keystore. An attacker holding such a private key, such as a trusted SAML 1.x partner, can forge assertions claiming another partner's issuer and sign in as that partner's users, including privileged ones.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.