CVE-2026-123538

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.4

Description OpenAM fails to verify that a signed SAML 1.x assertion or response was signed by the partner identified as its issuer. Instead, it accepts signatures from any certificate present in the OpenAM keystore. This allows an attacker possessing a private key from a trusted SAML 1.x partner to forge assertions that impersonate another partner's issuer, enabling unauthorized access as that partner's users, including those with privileged accounts.

Recommendations Update OpenAM to version 16.1.4 or later.