CVE-2026-123550 · Infrastructure
NO FIX YET · SEE WHAT TO DO
OpenAM before 16.1.4 accepts unsigned SAML assertions on the ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false. An unauthenticated remote attacker can submit forged assertions and obtain sessions as any mapped user, including administrators, and hijack single sign-on to dependent applications.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
OpenAM deployments before 16.1.4 that act as a SAML v2.0 service provider and accept the ECP (PAOS) or HTTP-Artifact bindings with WantAssertionsSigned set to false. Teams running OpenAM as a single sign-on hub for other applications are most exposed, since a forged login reaches every dependent app. Deployments on 16.1.4 or later, or that require signed assertions, are not affected.
Not affected if version-16.1.4-or-later, wantassertionssigned-true
Who cares openam, saml, self-hosted, sso
16.1.4 or later is not affected by the description givenWantAssertionsSigned is set to false on the SAML v2.0 service provider configuration16.1.4 or laterOpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts unsigned assertions on the ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false. Unauthenticated remote attackers can submit forged assertions to obtain sessions as any mapped user, including administrators, and hijack single sign-on to dependent applications.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.