{"id":"CVE-2026-123550","kind":"vulnerability","aliases":["CVE-2026-123550"],"related":[],"title":"OpenAM: SAML flaw lets attackers forge logins as any user","description":"OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts unsigned assertions on the ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false. Unauthenticated remote attackers can submit forged assertions to obtain sessions as any mapped user, including administrators, and hijack single sign-on to dependent applications.","summary":"OpenAM before 16.1.4 accepts unsigned SAML assertions on the ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false. An unauthenticated remote attacker can submit forged assertions and obtain sessions as any mapped user, including administrators, and hijack single sign-on to dependent applications.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","openam","saml","self-hosted","sso"],"not_affected_if":["version-16.1.4-or-later","wantassertionssigned-true"],"how_to_check":"- Check the OpenAM version in use; `16.1.4` or later is not affected by the description given\n- Check whether `WantAssertionsSigned` is set to false on the SAML v2.0 service provider configuration","fix":"- OpenAM: move to `16.1.4` or later","status":"open","published_at":"2026-11-08T02:16:46+00:00","first_seen_at":"2026-11-08T02:21:11+00:00","triaged_at":"2026-11-08T02:22:34+00:00","updated_at":"2026-11-08T02:22:34+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-08T02:22:34Z","model":"claude-haiku-5-5","output":{"fix":"- OpenAM: move to `16.1.4` or later","reach":"internet","title":"OpenAM: SAML flaw lets attackers forge logins as any user","impact":"high","summary":"OpenAM before 16.1.4 accepts unsigned SAML assertions on the ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false. An unauthenticated remote attacker can submit forged assertions and obtain sessions as any mapped user, including administrators, and hijack single sign-on to dependent applications.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["openam","saml","sso","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker gains administrator sessions and takes over single sign-on apps","analyst_note":"Confirm the affected version range and whether the vendor advisory on github.com names a fix beyond 16.1.4 and any workaround.","how_to_check":"- Check the OpenAM version in use; `16.1.4` or later is not affected by the description given\n- Check whether `WantAssertionsSigned` is set to false on the SAML v2.0 service provider configuration\n- unknown for other checks the sources do not state","plain_action":"","needs_analyst":true,"not_affected_if":["version-16.1.4-or-later","wantassertionssigned-true"],"who_is_affected":"OpenAM deployments before 16.1.4 that act as a SAML v2.0 service provider and accept the ECP (PAOS) or HTTP-Artifact bindings with WantAssertionsSigned set to false. Teams running OpenAM as a single sign-on hub for other applications are most exposed, since a forged login reaches every dependent app. Deployments on 16.1.4 or later, or that require signed assertions, are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.00077,"input_tokens":4316,"output_tokens":676,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-123550':13A,16A '-2026':12A,15A '16.1.4':26B,72C 'accept':27B,85C 'administr':60B,116C 'applic':69B,125C 'artifact':38B,95C 'assert':30B,51B,87C,107C 'attack':5A,47B,103C 'authent':75C 'bind':39B,96C 'bypass':76C 'contain':73C 'cve':11A,14A 'depend':68B,124C 'ecp':33B,90C 'fals':43B,100C 'flaw':3A 'forg':6A,50B,106C 'hijack':62B,118C 'host':22B 'http':37B,94C 'http-artifact':36B,93C 'includ':59B,115C 'infrastructur':17B 'let':4A 'login':7A 'map':57B,113C 'obtain':53B,109C 'openam':1A,18B,24B,70C 'pao':34B,91C 'provid':83C 'remot':46B,102C 'saml':2A,19B,29B,80C 'self':21B 'self-host':20B 'servic':82C 'session':54B,110C 'sign':65B,121C 'sign-on':64B,120C 'singl':63B,119C 'sso':23B 'submit':49B,105C 'unauthent':45B,101C 'unsign':28B,86C 'user':10A,58B,114C 'v2.0':81C 'vulner':77C 'wantassertionssign':41B,98C","nicknames":[],"mitigations":[],"who_affected":"OpenAM deployments before 16.1.4 that act as a SAML v2.0 service provider and accept the ECP (PAOS) or HTTP-Artifact bindings with WantAssertionsSigned set to false. Teams running OpenAM as a single sign-on hub for other applications are most exposed, since a forged login reaches every dependent app. Deployments on 16.1.4 or later, or that require signed assertions, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","infrastructure","openam","saml","selfhosted","sso"],"campaign_type":null,"search_a":"'-123550':13A,16A '-2026':12A,15A 'attack':5A 'cve':11A,14A 'flaw':3A 'forg':6A 'let':4A 'login':7A 'openam':1A 'saml':2A 'user':10A","search_b":"'16.1.4':26B 'accept':27B 'administr':60B 'applic':69B 'artifact':38B 'assert':30B,51B 'attack':47B 'bind':39B 'depend':68B 'ecp':33B 'fals':43B 'forg':50B 'hijack':62B 'host':22B 'http':37B 'http-artifact':36B 'includ':59B 'infrastructur':17B 'map':57B 'obtain':53B 'openam':18B,24B 'pao':34B 'remot':46B 'saml':19B,29B 'self':21B 'self-host':20B 'session':54B 'sign':65B 'sign-on':64B 'singl':63B 'sso':23B 'submit':49B 'unauthent':45B 'unsign':28B 'user':58B 'wantassertionssign':41B","search_c":"'16.1.4':72C 'accept':85C 'administr':116C 'applic':125C 'artifact':95C 'assert':87C,107C 'attack':103C 'authent':75C 'bind':96C 'bypass':76C 'contain':73C 'depend':124C 'ecp':90C 'fals':100C 'forg':106C 'hijack':118C 'http':94C 'http-artifact':93C 'includ':115C 'map':113C 'obtain':109C 'openam':70C 'pao':91C 'provid':83C 'remot':102C 'saml':80C 'servic':82C 'session':110C 'sign':121C 'sign-on':120C 'singl':119C 'submit':105C 'unauthent':101C 'unsign':86C 'user':114C 'v2.0':81C 'vulner':77C 'wantassertionssign':98C","first_public_at":"2026-10-22T08:48:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123550","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123550","severity":null,"published_at":"2026-11-08T02:16:46+00:00","modified_at":"2026-11-08T02:16:46+00:00","first_seen_at":"2026-11-08T02:21:11+00:00","fetched_at":"2026-11-08T02:21:11+00:00","note":null}],"documents":[{"id":99249,"url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-3j2f-qhrc-rjfj","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T08:48:42+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99250,"url":"https://www.vulncheck.com/advisories/openam-before-16.1.4-saml-authentication-bypass-via-unsigned-assertions","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}