{"id":"CVE-2026-123550","published":"2026-11-08T02:16:46.410","lastModified":"2026-11-10T22:13:29.767","description":"OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts unsigned assertions on the ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false. Unauthenticated remote attackers can submit forged assertions to obtain sessions as any mapped user, including administrators, and hijack single sign-on to dependent applications.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-290"],"vendors":[],"products":[],"references":[{"url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-3j2f-qhrc-rjfj","tags":[]},{"url":"https://www.vulncheck.com/advisories/openam-before-16.1.4-saml-authentication-bypass-via-unsigned-assertions","tags":[]}],"exploitRefs":[{"url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-3j2f-qhrc-rjfj","tags":[]}],"hasPoc":true,"ai":{"summary":"OpenAM before 16.1.4 has an authentication bypass in its SAML v2.0 service provider that allows unauthenticated attackers to submit forged, unsigned SAML assertions when WantAssertionsSigned is disabled, enabling full session hijacking of any user including admins.","exploitability":"Exploitation is trivial for remote attackers with network access to the SAML endpoint; no authentication or user interaction is required, and only basic SAML knowledge is needed to forge assertions targeting mapped users.","blast_radius":"Successful exploitation allows complete compromise of the OpenAM instance and any dependent applications relying on its SSO, leading to full data breach, privilege escalation, and lateral movement across integrated systems.","remediation":"Upgrade to OpenAM 16.1.4 or later, which patches the unsigned assertion acceptance vulnerability in SAML v2.0 ECP and HTTP-Artifact bindings.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","saml","ssm","web","remote-exploit"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:46:22.457Z"}}