CVE-2026-123550 is a critical authentication bypass in OpenAM's SAML v2.0 service provider before version 16.1.4: under certain configurations it accepts unsigned assertions, so remote attackers can log in as any mapped user.
What Is It
The flaw is in OpenAM's SAML v2.0 service provider. On the ECP (PAOS) and HTTP-Artifact bindings, OpenAM accepts unsigned assertions when WantAssertionsSigned is set to false. An unauthenticated remote attacker can submit a forged assertion and get a valid session as any mapped user, including administrators.
The weakness is classified as CWE-290 (Authentication Bypass by Spoofing). VulnCheck disclosed the issue, and the NVD record lists its status as "Received."
Why It Matters
OpenAM is an identity and access management platform, so the impact of a compromise may not stop at OpenAM itself. The NVD description says attackers can hijack single sign-on to the applications that depend on it. A forged assertion could therefore give access to services that trust the affected OpenAM instance. How far that reaches depends on how each deployment is federated.
The scores reflect how easy this is to exploit:
- CVSS 3.1: 9.8 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). It is network-reachable, low complexity, and needs no privileges or user interaction. - CVSS 4.0: 9.3 CRITICAL (secondary score from VulnCheck)
The CISA KEV entry supplied for this CVE is empty, so the supplied data does not confirm active exploitation. Exploit maturity is not defined in the CVSS 4.0 metrics.
What's Vulnerable
These OpenIdentityPlatform OpenAM Maven packages are affected in all versions before 16.1.4:
org.openidentityplatform.openam:openam-federation-libraryorg.openidentityplatform.openam:openam-auth-saml2
The record lists version 16.1.4 as unaffected. Exposure depends on a SAML v2.0 service provider configuration that uses the ECP (PAOS) or HTTP-Artifact bindings with WantAssertionsSigned set to false.
Patch Status
The affected-version data names OpenAM 16.1.4 as the first unaffected release. Organizations running OpenAM as a SAML v2.0 service provider should upgrade to 16.1.4 or later. They should also check whether any service provider configuration sets WantAssertionsSigned to false on the ECP or HTTP-Artifact bindings.
There is no CISA KEV entry, so no federal required action or due date applies. Remediation details are in the GitHub security advisory and the VulnCheck advisory listed below.