PT-2026-139825
CVE-2026-123544
·
Published
2026-11-08
·
Updated
2026-11-08
Description by
CVSS 3.1
6.8
MediumMetricsAV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Name of the Vulnerable Software and Affected Versions
OpenAM versions prior to 16.1.4
OpenAM client SDK versions prior to 16.1.4
Description
Insufficient validation of responses on the internal server-to-server SOAP channel allows network-positioned attackers to compromise integrity and availability. Attackers who control a site server or intercept unencrypted traffic can crash receiving processes, tamper with writable files, and potentially execute arbitrary code.
Recommendations
Update OpenAM to version 16.1.4 or later.
Update OpenAM client SDK to version 16.1.4 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾