CVE-2026-123544
Received Received - Intake

OpenAM SOAP Channel Response Validation Flaw

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal server-to-server SOAP channel, allowing network-positioned attackers to affect integrity and availability. Attackers who intercept unencrypted traffic or control a site server can crash receiving processes, tamper with writable files, and possibly execute code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123544
EUVD
EUVD-2026-119429

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
forgerock openam to 16.1.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-470 The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenAM before version 16.1.4 and its client SDK do not properly validate responses on the internal server-to-server SOAP channel. This allows attackers positioned on the network to manipulate data integrity and availability. Attackers can crash processes, alter writable files, or potentially execute arbitrary code by intercepting unencrypted traffic or compromising a site server.

Detection Guidance

Detecting this vulnerability requires monitoring for unusual traffic patterns or crashes in OpenAM servers. Check for unencrypted SOAP channel traffic between servers and inspect logs for unexpected file modifications or process crashes. No specific commands are provided in the context.

Impact Analysis

If exploited, this vulnerability could lead to service disruption by crashing OpenAM processes, unauthorized modification of critical files, or remote code execution. Organizations using vulnerable versions may face data tampering, unauthorized access, or system downtime, depending on the attacker's goals and network position.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized data modification or access, which is a direct violation of integrity and confidentiality principles in GDPR and HIPAA. Organizations may face regulatory penalties, loss of certification, or reputational damage due to failed audits or data breaches resulting from exploitation.

Mitigation Strategies
  • Upgrade OpenAM to version 16.1.4 or later to address the insufficient response validation issue.
  • Ensure all internal server-to-server SOAP communications are encrypted to prevent interception.
  • Restrict network access to the SOAP channel to trusted servers only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123544. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...