OpenIdentityPlatform's advisory rates it CVSS 3.1 9.8 Critical and fixed it in OpenAM 16.1.4.
What it allows
CVE-2026-123550 is a signature gap in OpenAM's SAML v2.0 service provider. When OpenAM acts as a hosted service provider, it should require a signature on every binding through which it accepts a login response. The advisory says it does not.
On some bindings the only safeguard is the service provider's own WantAssertionsSigned setting, and the hosted metadata OpenAM generates sets that setting to false by default. Under the right conditions, OpenAM can accept an assertion the identity provider never signed and issue a session for the user it names.
The advisory lists three required conditions. The metadata must advertise the ECP (PAOS) assertion consumer service, which the generated metadata does by default. WantAssertionsSigned must be off, also the generated default, and the service provider must have an encryption key configured, which an admin chooses.
What CVE-2026-123550 Lets an Attacker Do
An unauthenticated remote attacker can obtain an OpenAM session as one of its users, with no credentials and no user interaction, per the advisory. Which accounts are reachable depends on how the service provider maps an assertion to a local account.
The advisory says that where the mapping uses an attribute or the assertion's name identifier as the user id, any account is reachable. Administrative accounts are not excluded, and every application that relies on that OpenAM instance for single sign-on is exposed through the hijacked session.
The advisory also closes two related gaps. An assertion delivered over the HTTP-Artifact binding was accepted unsigned when the resolution service was reached over plain http. The one-time-use replay check covered only the HTTP-POST binding.
CVSS Score and CWE for CVE-2026-123550
VulnCheck, the CNA, scores CVE-2026-123550 as CVSS v3.1 9.8 Critical, with CVSS v4.0 9.3 Critical as a secondary metric. The advisory lists the same 9.8 score and does not publish a CVSS v4.0 vector.
The CVE record lists the primary weakness as CWE-290, authentication bypass by spoofing. The advisory also maps CWE-294, capture-replay, and CWE-347, improper signature verification. See our CVSS entry for how to read the score.
What OpenIdentityPlatform and CISA KEV Say
The advisory says OpenAM 16.1.4 is the first fixed release, and all earlier releases are affected. As of CISA catalog version 2026.11.06, CVE-2026-123550 is not in the Known Exploited Vulnerabilities catalog. The advisory and the CVE record do not state whether the flaw has been exploited. Our KEV glossary entry explains the catalog.
Who is affected
The CVE record and the advisory both list OpenAM up to and including 16.1.3 as affected. The advisory names the SAML authentication and federation modules, with OpenAM 16.1.4 as the first fixed release.
Only a hosted SAML v2.0 service provider is affected; the advisory says OpenAM deployments that do not act as a service provider are not exposed. Fixed in 16.1.4, a hosted service provider requires a signed response or signed assertions on every binding, whatever WantAssertionsSigned says.
The advisory flags one upgrade-breaking change. A service provider federated over HTTP-Artifact with an OpenAM identity provider now refuses an unsigned artifact-delivered assertion. Operators must set WantAssertionsSigned to true on the identity provider's copy of the metadata first.
GHSA-3j2f-qhrc-rjfj credits rockmelodies as the reporter. We recommend reviewing every hosted SAML v2.0 service provider with our vulnerability management guide.
OpenAM 16.1.4 also fixes two other critical flaws we cover separately: a self-registration attribute bypass, CVE-2026-123549, and a session-token disclosure, CVE-2026-123551. Deployments on 16.1.3 or earlier should patch for all three.
Timeline
- 22 Oct 2026
OpenIdentityPlatform releases OpenAM 16.1.4 and publishes the advisory GHSA-3j2f-qhrc-rjfj.
- 6 Nov 2026
VulnCheck, the CNA, reserves CVE-2026-123550, per the CVE record.
- 8 Nov 2026
VulnCheck publishes the CVE record, and NVD publishes its entry.
What to do
-
Find Every Hosted SAML v2.0 Service Provider
List every OpenAM instance that acts as a hosted SAML v2.0 service provider. The advisory says deployments that are not a service provider are not exposed.
-
Upgrade to OpenAM 16.1.4
The advisory says 16.1.4 requires a signed response or signed assertions on every binding. This closes the gap regardless of the WantAssertionsSigned setting.
-
Require Signed Assertions Until You Upgrade
The advisory recommends enabling Assertions Signed on every hosted service provider, or setting WantAssertionsSigned to true in its metadata. Confirm each trusted identity provider signs its assertions first.
-
Remove or Restrict the ECP Endpoint if Unused
Where ECP is not used, the advisory says to remove the ECP assertion consumer service from the metadata. We recommend also blocking the endpoint at the reverse proxy.
-
Review SAML Single Sign-On Audit Logs
The advisory recommends reviewing audit logs for SAML v2.0 single sign-on through the ECP binding, especially for privileged accounts. Use https for every artifact resolution call too.
Frequently Asked Questions
Which OpenAM versions does CVE-2026-123550 affect?
The CVE record and the advisory both list OpenAM up to and including 16.1.3 as affected. OpenAM 16.1.4 is the first fixed release.
Does the attacker need to steal a signing key?
No. The advisory says the attacker submits an assertion that was never signed at all, on a binding where OpenAM's default settings do not require a signature.
Is every OpenAM deployment a SAML service provider?
No. The advisory says only a hosted SAML v2.0 service provider is affected, and OpenAM deployments that do not act as one are not exposed.
Can the attacker reach an administrator account?
The advisory does not exclude admin accounts. Which accounts are reachable depends on how the service provider maps an assertion to a local account.
Is CVE-2026-123550 in the CISA KEV catalog?
It is not in catalog version 2026.11.06. The advisory and the CVE record do not state whether the flaw has been exploited.
Sources
- CVE-2026-123550 RecordCVE Program / VulnCheck CNA
- CVE-2026-123550NVD
- GHSA-3j2f-qhrc-rjfj, OpenAM SAML v2.0 service provider accepts unsigned assertions on some bindingsOpenAM on GitHub
- OpenAM 16.1.4 release notesOpenAM on GitHub
- OpenAM before 16.1.4 SAML Authentication Bypass via Unsigned AssertionsVulnCheck
- Known Exploited Vulnerabilities CatalogCISA
