Vulnerability in Openidentityplatform Openam
CVE-2026-123538
OpenAM before 16.1.4 does not verify that a signed SAML 1.x assertion or response was signed by the partner named as its issuer, accepting a signature from any certificate in OpenAM's keystore. An attacker holding such a private key, such as a trusted SAML 1.x partner, can forge assertions claiming another partner's issuer and sign in as that partner's users, including privileged ones.
Published .
CVSS v3 metric
CVSS v3 base score 6.6 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- GitHub Security Advisory (GHSA-j56q-q3r3-hg7f) (vendor-advisory)
- VulnCheck Advisory: OpenAM before 16.1.4 SAML 1.x Signature Verification Issuer Impersonation (third-party-advisory)
Frequently asked questions
- What is CVE-2026-123538?
- CVE-2026-123538 is a medium-severity vulnerability in Openidentityplatform Openam, classified under Improper Verification of Cryptographic Signature. CVSS score: 6.6/10. Published 2026-11-08.
- How severe is CVE-2026-123538?
- Medium severity. CVSS v3 base score is 6.6 out of 10.