OpenAM: Authentication bypass in SAML v2.0 service provider (CVE-2026-123550)
OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts unsigned assertions on the ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false.
CVE search metadata
CVE search record: CVE-2026-123550. Severity: critical. CVSS: 9.8. KEV: no. Brief: OpenAM: Authentication bypass in SAML v2.0 service provider (CVE-2026-123550). Brief link: https://feed.craftedsignal.io/briefs/2026-11-openam-auth-bypass/
CVE search record: CVE-2026-123551. KEV: no. Brief: OpenAM: Authentication bypass in SAML v2.0 service provider (CVE-2026-123550). Brief link: https://feed.craftedsignal.io/briefs/2026-11-openam-auth-bypass/
Triage facts
Revision 2- Evidence
- Unknown
- Severity
- Critical
- Sources
- 13 public sources
- Freshness
- Revision 2Nov 8, 03:15 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- A2Roughly even chance
Revision history 1 entry · Revision 2
- Revision 2
new vendor
Changed: affected_vendors, claim_state, lastmod, references, updates
Sources: 1
OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts unsigned assertions on the ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false. Unauthenticated remote attackers can submit forged assertions to obtain sessions as any mapped user, including administrators, and hijack single sign-on to dependent applications.