CVE-2026-123550
OpenIdentityPlatform OpenAM
Published 8 Nov 2026 · updated 8 Nov 2026 · Received
9.3 Critical · CVSS 4.0, vulncheck.com
Description
OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts unsigned assertions on the ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false. Unauthenticated remote attackers can submit forged assertions to obtain sessions as any mapped user, including administrators, and hijack single sign-on to dependent applications.