Isazajuancarlos

OpenAM fails to verify that a signed SAML 1.x assertion or response was signed by the partner identified as its issuer. Instead, it accepts signatures from any certificate present in the OpenAM keystore. This allows an attacker possessing a private key from a trusted SAML 1.x partner to forge assertions that impersonate another partner's issuer, enabling unauthorized access as that partner's users, including those with privileged accounts.

An incorrect authorization flaw exists in the User Service API. The system verifies the `user.read` permission against the caller's organization instead of the organization that owns the target user. An authenticated member with org-scoped `user.read` permissions can use the 'GET /v2/users/{userId}/authentication methods' endpoint to identify the authentication method types registered by users in other organizations.