{"id":"CVE-2026-123543","kind":"vulnerability","aliases":["CVE-2026-123543"],"related":[],"title":"OpenAM: unauthenticated serialized Java input exhausts server resources, causing denial of service","description":"OpenAM before 16.1.4 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending serialized Java data without size or structure limits. Attackers can send small crafted requests to remote SDK endpoints, classic login pages, or the administration console to block authentication, session validation and policy decisions.","summary":"OpenAM before 16.1.4 accepts serialized Java data without size or structure limits. An unauthenticated attacker can send small crafted requests to exhaust server resources and block login, session validation and policy decisions.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","openam","other","self-hosted","sso"],"not_affected_if":["internal-only-endpoints","version-16.1.4-or-later"],"how_to_check":"- Check the installed OpenAM version and compare it with `16.1.4`.\n- Review whether remote SDK endpoints, login pages or the administration console are reachable from the internet.","fix":"- OpenAM: upgrade to `16.1.4` or later.","status":"open","published_at":"2026-11-08T02:16:45+00:00","first_seen_at":"2026-11-08T02:21:10+00:00","triaged_at":"2026-11-08T02:23:11+00:00","updated_at":"2026-11-08T02:23:11+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-08T02:23:11Z","model":"claude-haiku-5-5","output":{"fix":"- OpenAM: upgrade to `16.1.4` or later.","reach":"internet","title":"OpenAM: unauthenticated serialized Java input exhausts server resources, causing denial of service","impact":"medium","summary":"OpenAM before 16.1.4 accepts serialized Java data without size or structure limits. An unauthenticated attacker can send small crafted requests to exhaust server resources and block login, session validation and policy decisions.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openam","self-hosted","sso","java"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Authentication and policy decisions stop working through resource exhaustion","analyst_note":"Confirm which OpenAM endpoints are affected and whether the vendor advisory at github.com lists additional configuration-based mitigations.","how_to_check":"- Check the installed OpenAM version and compare it with `16.1.4`.\n- Review whether remote SDK endpoints, login pages or the administration console are reachable from the internet.","plain_action":"","needs_analyst":true,"not_affected_if":["version-16.1.4-or-later","internal-only-endpoints"],"who_is_affected":"Organizations running OpenAM before 16.1.4 as an access management or single sign-on server. Exposure is highest where remote SDK endpoints, classic login pages or the administration console accept requests from untrusted networks. Installations already on 16.1.4 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000705,"input_tokens":4281,"output_tokens":554,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123543':15A,18A '-2026':14A,17A '16.1.4':28B,60C 'accept':29B 'administr':100C 'allow':68C 'attack':40B,70C,85C 'authent':104C 'block':51B,103C 'caus':9A 'classic':95C 'consol':101C 'contain':61C 'craft':44B,89C 'cve':13A,16A 'data':32B,79C 'decis':57B,109C 'denial':10A,63C 'endpoint':94C 'exhaust':6A,47B,72C 'host':24B 'input':5A 'java':4A,19B,31B,78C 'limit':37B,84C 'login':52B,96C 'openam':1A,20B,26B,58C 'page':97C 'polici':56B,108C 'remot':92C 'request':45B,90C 'resourc':8A,49B,74C 'sdk':93C 'self':23B 'self-host':22B 'send':42B,76C,87C 'serial':3A,30B,77C 'server':7A,48B,73C 'servic':12A,65C 'session':53B,105C 'size':34B,81C 'small':43B,88C 'sso':25B 'structur':36B,83C 'unauthent':2A,39B,69C 'valid':54B,106C 'vulner':66C 'without':33B,80C","nicknames":[],"mitigations":[],"who_affected":"Organizations running OpenAM before 16.1.4 as an access management or single sign-on server. Exposure is highest where remote SDK endpoints, classic login pages or the administration console accept requests from untrusted networks. Installations already on 16.1.4 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","java","openam","other","selfhosted","sso"],"campaign_type":null,"search_a":"'-123543':15A,18A '-2026':14A,17A 'caus':9A 'cve':13A,16A 'denial':10A 'exhaust':6A 'input':5A 'java':4A 'openam':1A 'resourc':8A 'serial':3A 'server':7A 'servic':12A 'unauthent':2A","search_b":"'16.1.4':28B 'accept':29B 'attack':40B 'block':51B 'craft':44B 'data':32B 'decis':57B 'exhaust':47B 'host':24B 'java':19B,31B 'limit':37B 'login':52B 'openam':20B,26B 'polici':56B 'request':45B 'resourc':49B 'self':23B 'self-host':22B 'send':42B 'serial':30B 'server':48B 'session':53B 'size':34B 'small':43B 'sso':25B 'structur':36B 'unauthent':39B 'valid':54B 'without':33B","search_c":"'16.1.4':60C 'administr':100C 'allow':68C 'attack':70C,85C 'authent':104C 'block':103C 'classic':95C 'consol':101C 'contain':61C 'craft':89C 'data':79C 'decis':109C 'denial':63C 'endpoint':94C 'exhaust':72C 'java':78C 'limit':84C 'login':96C 'openam':58C 'page':97C 'polici':108C 'remot':92C 'request':90C 'resourc':74C 'sdk':93C 'send':76C,87C 'serial':77C 'server':73C 'servic':65C 'session':105C 'size':81C 'small':88C 'structur':83C 'unauthent':69C 'valid':106C 'vulner':66C 'without':80C","first_public_at":"2026-10-22T09:19:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123543","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123543","severity":null,"published_at":"2026-11-08T02:16:45+00:00","modified_at":"2026-11-08T02:16:45+00:00","first_seen_at":"2026-11-08T02:21:10+00:00","fetched_at":"2026-11-08T02:21:10+00:00","note":null}],"documents":[{"id":99235,"url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-x7wr-5gxg-v833","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T09:19:20+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99236,"url":"https://www.vulncheck.com/advisories/openam-before-16.1.4-unauthenticated-dos-via-unbounded-java-deserialisation","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}