CVE-2026-123544 · Other
NO FIX YET · SEE WHAT TO DO
OpenAM before 16.1.4 and its client SDK do not properly validate responses on the internal server-to-server SOAP channel. An attacker positioned on the network who intercepts unencrypted traffic or controls a site server can crash receiving processes, tamper with writable files, and possibly execute code.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organizations running OpenAM before 16.1.4, and any application using its client SDK, where the internal server-to-server SOAP traffic can be intercepted or a site server is controlled by an attacker. Deployments that encrypt the internal channel and restrict network positions are less exposed. The sources do not say which specific configurations are default.
Not affected if encrypted-internal-channel, openam-16.1.4-or-later
Who cares identity-management, openam, soap
16.1.416.1.4 or laterOpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal server-to-server SOAP channel, allowing network-positioned attackers to affect integrity and availability. Attackers who intercept unencrypted traffic or control a site server can crash receiving processes, tamper with writable files, and possibly execute code.
This page as .md · .json · CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.