CVE-2026-123538
📛 CVE Title
OpenAM before 16.1.4 SAML 1.x Signature Verification Issuer Impersonation
Description
OpenAM before 16.1.4 does not verify that a signed SAML 1.x assertion or response was signed by the partner named as its issuer, accepting a signature from any certificate in OpenAM's keystore. An attacker holding such a private key, such as a trusted SAML 1.x partner, can forge assertions claiming another partner's issuer and sign in as that partner's users, including privileged ones.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- VulnCheck
- CVSS severity
- HIGH
- CVSS score
- 7.5 / 10
- CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N- Effective score
- 7.5 / 10 HIGH source: CNA overview
- CWE(s)
-
CWE-347 - Reserved
- 2026-11-06
- Published
- 2026-11-08 01:37 UTC
- Last updated
- 2026-11-08 01:37 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123538.json
- Linked Threat
- CVE-2026-123538 — OpenAM before 16.1.4 SAML 1.x Signature Verification Issuer Impersonation
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-119423
EUVD enrichment is queued; refresh the page in a few seconds.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| OpenIdentityPlatform | OpenAM |
0 (affected),
16.1.4 (unaffected)
|
— |
Vendor references (2)
References embedded in the original CVE record by the assigning CNA.
- GitHub Security Advisory (GHSA-j56q-q3r3-hg7f) vendor-advisory
- VulnCheck Advisory: OpenAM before 16.1.4 SAML 1.x Signature Verification Issuer Impersonation third-party-advisory
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
Remediations (10)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:cybersecuritynews.com
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued Binding Operational Directive (BOD) 26-04, titled "Prioritizing Security Updates Based on Risk," compelling all Federal Civilian Executive Branch (FCEB) agencies to remediate the most dangerous known exploited vulnerabilities within just three calendar days.
2026-11-08 10:25 UTC -
web:cyberupdates365.com
Track critical CVE vulnerabilities 2026 with verified enterprise patch guides. Fix zero-days across VMware, WordPress, Windows, and cloud infrastructure.
2026-11-08 10:25 UTC -
web:cycode.com
Learn about sshole ( CVE - 2026 -123158), an OpenSSH authentication bypass vulnerability affecting Alpine Linux, key exposure criteria, affected public images, and fix guidance.
2026-11-08 10:25 UTC -
web:devops-daily.com
Read-only check for CVE - 2026 -123158: is your Alpine sshd affected by the password authentication bypass, fixed, or still running the old daemon? Tested on Alpine 3.21 to 3.24 and edge.
2026-11-08 10:25 UTC -
web:endpointweekly.com
All 633 CVEs from September 2026 Patch Tuesday — searchable, filterable, with plain-English IT admin notes on every vulnerability. Includes CVE - 2026 -81963, the exploited Windows Update Stack EoP, and the five CVEs KB5124008 does not fix .
2026-11-08 10:25 UTC -
web:safe.security
By SAFE Threat Research Team Overview An account with no valid password should never accept password authentication. A newly disclosed OpenSSH vulnerability breaks that fundamental security assumption, potentially allowing attackers to gain unauthorized access to Linux systems and, in certain configurations, achieve full root compromise. Disclosed on November 5, 2026 , SSHole ( CVE - 2026 -123158 ...
2026-11-08 10:25 UTC -
web:support.esri.com
The issues resolved by these patches are listed in the Issues addressed with this patch section below. As part of the patch installation, the ArcGIS Server service is stopped and restarted. The restart may take several minutes depending on the number of services published on the ArcGIS Server site. This patch can be uninstalled as outlined in the Uninstalling this patch on Windows and ...
2026-11-08 10:25 UTC -
web:vulmon.com
Vulnerability Summary OpenAM versions prior to 16.1.4 accept forged SAML 1.x assertions and responses. An attacker with a private key from the keystore can impersonate other SAML 1.x partners' users, including those with elevated privileges. This occurs because the software does not verify the issuer of the signed assertion or response.
2026-11-08 10:25 UTC -
web:www.aikido.dev
CVE remediation is fixing known flaws in the software you run. Why upgrading often fails, what remediation actually involves, and how backporting fixes it.
2026-11-08 10:25 UTC -
web:www.strix.ai
How severe is CVE-2026-123538 ? CVE-2026-123538 has a CVSS score of 6.6/10 (MEDIUM severity). How do I fix CVE-2026-123538 ? Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
2026-11-08 10:25 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-123538.json.
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/org.openidentityplatform.openam/openam-federation-library",
"product": "OpenAM",
"vendor": "OpenIdentityPlatform",
"versions": [
{
"lessThan": "16.1.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "16.1.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openidentityplatform:openam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.1.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "isazajuancarlos"
},
{
"lang": "en",
"type": "remediation developer",
"value": "vharseko"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "maximthomas"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "tsujiguchitky"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenAM before 16.1.4 does not verify that a signed SAML 1.x assertion or response was signed by the partner named as its issuer, accepting a signature from any certificate in OpenAM's keystore. An attacker holding such a private key, such as a trusted SAML 1.x partner, can forge assertions claiming another partner's issuer and sign in as that partner's users, including privileged ones."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T01:37:45.221Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-j56q-q3r3-hg7f)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-j56q-q3r3-hg7f"
},
{
"name": "VulnCheck Advisory: OpenAM before 16.1.4 SAML 1.x Signature Verification Issuer Impersonation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openam-before-16.1.4-saml-1-x-signature-verification-issuer-impersonation"
}
],
"title": "OpenAM before 16.1.4 SAML 1.x Signature Verification Issuer Impersonation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123538",
"datePublished": "2026-11-08T01:37:45.221Z",
"dateReserved": "2026-11-06T00:48:46.279Z",
"dateUpdated": "2026-11-08T01:37:45.221Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}