{"id":"CVE-2026-123550","title":"OpenAM before 16.1.4 SAML Authentication Bypass via Unsigned Assertions","summary":"OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts unsigned assertions on the ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false. Unauthenticated remo…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-290"],"vendor":"OpenIdentityPlatform","product":"OpenAM","affected":["OpenAM < 16.1.4","OpenAM < 16.1.4"],"published":"2026-11-08","updated":"2026-11-08","sourceUpdated":"2026-11-08T01:37:54.178Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-123550","references":[{"url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-3j2f-qhrc-rjfj","label":"GitHub Security Advisory (GHSA-3j2f-qhrc-rjfj)"},{"url":"https://www.vulncheck.com/advisories/openam-before-16.1.4-saml-authentication-bypass-via-unsigned-assertions","label":"VulnCheck Advisory: OpenAM before 16.1.4 SAML Authentication Bypass via Unsigned Assertions"}],"tags":["cve.org"],"ingestedAt":"2026-11-08T02:43:18.671Z","slug":"CVE-2026-123550","body":"## Overview\n\nOpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts unsigned assertions on the ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false. Unauthenticated remote attackers can submit forged assertions to obtain sessions as any mapped user, including administrators, and hijack single sign-on to dependent applications.\n\n## Affected\n\n- `OpenAM < 16.1.4`\n- `OpenAM < 16.1.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}