Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

OpenAM allows attackers to log in as any user

CVE-2026-123550 · published today
Summary

Versions of OpenAM prior to 16.1.4 let anyone send specially crafted login messages that are accepted without a digital signature. This can let an unauthenticated person create a session for any existing user, even administrators, and take over single sign‑on access to linked applications. Update OpenAM to version 16.1.4 or later, and ensure the setting that requires signed assertions is enabled.

What to do
  • Update openidentityplatform openam to version 16.1.4 or later.
Affected software
VendorProductAffected versions
openidentityplatform openam < 16.1.4
Original advisory text
OpenAM before 16.1.4 SAML Authentication Bypass via Unsigned Assertions
OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts unsigned assertions on the ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false. Unauthenticated remote attackers can submit forged assertions to obtain sessions as any mapped user, including administrators, and hijack single sign-on to dependent applications.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.9 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-290Authentication Bypass by Spoofing
Timeline
Published8 Nov 2026
Updated8 Nov 2026
First seen8 Nov 2026
Sources
CVE-2026-123550 · NVD
CVE-2026-123550 · MITRE
CVE-2026-123550 · OSV
GHSA-3j2f-qhrc-rjfj · GHSA
Track software like this
Free during beta