CVE-2026-123540 · Package
NO FIX YET · SEE WHAT TO DO
OpenAM before 16.1.4 does not fully encode output in the service provider auto-submitted form, so a SAML 1.x identity provider can inject content. An attacker who controls a trusted identity provider can change attribute names or values before they reach the application.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running OpenAM as a SAML service provider that accept SAML 1.x assertions. The risk depends on whether an untrusted or compromised identity provider can reach the auto-submitted form. Deployments on newer OpenAM releases, or that use no SAML 1.x identity provider, can skip it.
Not affected if no-saml-1x-idp, openam-16.1.4-or-later
Who cares identity, openam, saml
16.1.4.16.1.4 or later (per the advisory data in the sources).OpenAM before 16.1.4 contains an incomplete output encoding vulnerability that allows a SAML 1.x identity provider to alter attribute values by injecting unencoded content into the service provider auto-submitted form. Attackers controlling a trusted identity provider can craft assertion attribute names or values that reach the target application in modified form, undermining the integrity of received attributes.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.