CVE-2026-123550

Summary

OpenAM before 16.1.4 has an authentication bypass in its SAML v2.0 service provider that allows unauthenticated attackers to submit forged, unsigned SAML assertions when WantAssertionsSigned is disabled, enabling full session hijacking of any user including admins.

Exploitability

Exploitation is trivial for remote attackers with network access to the SAML endpoint; no authentication or user interaction is required, and only basic SAML knowledge is needed to forge assertions targeting mapped users.

Blast radius

Successful exploitation allows complete compromise of the OpenAM instance and any dependent applications relying on its SSO, leading to full data breach, privilege escalation, and lateral movement across integrated systems.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to OpenAM 16.1.4 or later, which patches the unsigned assertion acceptance vulnerability in SAML v2.0 ECP and HTTP-Artifact bindings.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.