CVE-2026-123552

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.4

Description An issue exists in the certificate CRL (Certificate Revocation List) checking process where the system fetches CRLs from the distribution point specified in a presented certificate without restricting the destination or verifying the signature of the downloaded CRL. This allows an attacker with a certificate chained to a trusted CA to force the server to make requests to internal hosts, capture CRL update credentials, overwrite stored revocation data to block authentication for that CA, and exhaust authentication threads.

Recommendations Update to version 16.1.4.