CVE-2026-123550
Received Received - Intake

Authentication Bypass in OpenAM via SAML Assertions

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts unsigned assertions on the ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false. Unauthenticated remote attackers can submit forged assertions to obtain sessions as any mapped user, including administrators, and hijack single sign-on to dependent applications.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123550
EUVD
EUVD-2026-119435

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
forgerock openam to 16.1.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in OpenAM versions before 16.1.4. It allows unauthenticated remote attackers to submit forged unsigned SAML assertions to bypass authentication when the WantAssertionsSigned setting is false. This specifically affects the ECP (PAOS) and HTTP-Artifact bindings.

Detection Guidance

Check OpenAM configuration for SAML bindings with WantAssertionsSigned set to false. Inspect SAML traffic for unsigned assertions on ECP (PAOS) and HTTP-Artifact bindings. Use SAML decoders to analyze assertion signatures and verify if assertions are properly signed.

Impact Analysis

Attackers can impersonate any user, including administrators, and hijack single sign-on sessions for dependent applications. This could lead to unauthorized access to sensitive data, system control, and potential compromise of all services relying on OpenAM for authentication.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. It could lead to unauthorized data exposure, violating GDPR's integrity and confidentiality principles, and HIPAA's safeguards for protected health information, potentially resulting in legal penalties and loss of trust.

Mitigation Strategies

Upgrade OpenAM to version 16.1.4 or later. Enable WantAssertionsSigned in SAML metadata. Remove unused ECP services. Avoid unnecessary encryption keys. Ensure HTTPS is enforced for artifact resolution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123550. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...