CVE-2026-123540
Received Received - Intake

Incomplete Output Encoding in OpenAM SAML 1.x Attribute Handling

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
OpenAM before 16.1.4 contains an incomplete output encoding vulnerability that allows a SAML 1.x identity provider to alter attribute values by injecting unencoded content into the service provider auto-submitted form. Attackers controlling a trusted identity provider can craft assertion attribute names or values that reach the target application in modified form, undermining the integrity of received attributes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123540
EUVD
EUVD-2026-119425

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
forgerock openam to 16.1.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenAM before version 16.1.4 has an incomplete output encoding flaw in SAML 1.x Form POST. This allows a SAML 1.x identity provider to inject unencoded content into attribute values, altering them before they reach the service provider's auto-submitted form. Attackers controlling a trusted identity provider can manipulate assertion attribute names or values, compromising their integrity.

Detection Guidance

To detect this vulnerability, check if your OpenAM instance is running a version before 16.1.4. Verify SAML 1.x service provider configurations and inspect network traffic for unencoded attribute values in SAML assertions. Monitor logs for unexpected attribute modifications.

Impact Analysis

If you use OpenAM as a SAML 1.x service provider with trusted identity providers, attackers controlling those providers could alter attribute values sent to your applications. This undermines data integrity but does not enable script execution in browsers. The impact is limited to attribute manipulation in transit.

Mitigation Strategies

Upgrade OpenAM to version 16.1.4 or later. If upgrading is not immediately possible, disable SAML 1.x profile endpoints if unused. Restrict trusted identity providers and validate received attribute values in target applications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123540. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...