OpenAM before 16.1.4 SAML Authentication Bypass via Unsigned Assertions
Affects OpenAM releases up to and including 16.1.3 when a hosted SAML v2.0 service provider advertises the ECP (PAOS) assertion consumer service with assertion signing off. Fixed in 16.1.4.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 16.1.4
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Hosted SAML v2.0 service provider whose metadata advertises the ECP (PAOS) assertion consumer service Assertions Signed (WantAssertionsSigned) is off Service provider has an encryption key configured Affects OpenAM releases up to and including 16.1.3
- Published
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 21/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts unsigned assertions on the ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false. Unauthenticated remote attackers can submit forged assertions to obtain sessions as any mapped user, including administrators, and hijack single sign-on to dependent applications.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure12/25Specific setups only, reachable over the network without a login
- Reach?/20Unknown. No tracked technology or package matched
- Severity9.3/10CVSS 9.3
- No patch0/5No signal
What would change the score
- Would score about 71 if added to CISA KEV
- Would score about 66 if CISA's SSVC rates exploitation active
What to do
Check whether your setup matches what the bug needs.
Hosted SAML v2.0 service provider whose metadata advertises the ECP (PAOS) assertion consumer service Assertions Signed (WantAssertionsSigned) is off Service provider has an encryption key configured Affects OpenAM releases up to and including 16.1.3Upgrade to a fixed version: 16.1.4.
Workaround: Require signed assertions by enabling Assertions Signed (WantAssertionsSigned) for every hosted service provider, and related mitigations such as removing the ECP assertion consumer service if unused
Timeline
- CVE published
- First seen by cve.now
- Posted on X by cve.now
Affected versions
- OpenIdentityPlatform OpenAM
fixed in 16.1.4
Evidence 2
- Advisory
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-123550
Is CVE-2026-123550 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
Because unsigned SAML assertions are accepted, an unauthenticated remote attacker can obtain an OpenAM session on the service provider as one of its users, including administrators. That can let them hijack single sign-on to dependent applications.Source: github.com
Which versions are affected by CVE-2026-123550?
OpenAM: before 16.1.4.Source: cve.now feed data
Am I affected, and how do I check?
All OpenAM releases up to and including 16.1.3 are in scope, and only hosted SAML v2.0 service providers that meet all three conditions: the metadata advertises the ECP (PAOS) assertion consumer service, Assertions Signed (WantAssertionsSigned) is off, and an encryption key is configured. To check, review the hosted service provider's metadata for an ECP/PAOS assertion consumer service and the WantAssertionsSigned setting in its configuration, and confirm your OpenAM version.Source: github.com
How do I fix CVE-2026-123550?
Upgrade to OpenAM 16.1.4, which contains the fix.Source: github.com