---
id: "CVE-2026-123543"
page: "https://infrastack.ai/live/CVE-2026-123543"
kind: "vulnerability"
aliases: ["CVE-2026-123543"]
title: "OpenAM: unauthenticated serialized Java input exhausts server resources, causing denial of service"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["java", "openam", "other", "self-hosted", "sso"]
not_affected_if: ["internal-only-endpoints", "version-16.1.4-or-later"]
published_at: "2026-11-08T02:16:45+00:00"
first_seen_at: "2026-11-08T02:21:10+00:00"
updated_at: "2026-11-08T02:23:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123543", "first_seen_at": "2026-11-08T02:21:10+00:00"}]
exploit_sources: []
---

# OpenAM: unauthenticated serialized Java input exhausts server resources, causing denial of service

Link for people: https://infrastack.ai/live/CVE-2026-123543 (this .md is for agents)

OpenAM before 16.1.4 accepts serialized Java data without size or structure limits. An unauthenticated attacker can send small crafted requests to exhaust server resources and block login, session validation and policy decisions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OpenAM version and compare it with `16.1.4`.
- Review whether remote SDK endpoints, login pages or the administration console are reachable from the internet.

## Fix

- OpenAM: upgrade to `16.1.4` or later.

## Timeline

- 2026-11-08T02:21:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123543

## Documents

- [advisory] Vendor advisory: github.com https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-x7wr-5gxg-v833
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openam-before-16.1.4-unauthenticated-dos-via-unbounded-java-deserialisation

## From the sources

OpenAM before 16.1.4 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending serialized Java data without size or structure limits. Attackers can send small crafted requests to remote SDK endpoints, classic login pages, or the administration console to block authentication, session validation and policy decisions.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_