Issuer impersonation in OpenAM SAML 1.x signature verification
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-347.
Summary
OpenAM before 16.1.4 does not verify that a signed SAML 1.x assertion or response was signed by the partner named as its issuer, so it accepts a signature from any certificate in its keystore. An attacker holding such a private key, such as a trusted SAML 1.x partner, can forge assertions that claim another partner's issuer and sign in as that partner's users, including privileged ones. The flaw is classified as CWE-347.
Written with Claude Haiku 5.5 from the sources below · 2026-11-08
Description from the CNA
OpenAM before 16.1.4 does not verify that a signed SAML 1.x assertion or response was signed by the partner named as its issuer, accepting a signature from any certificate in OpenAM's keystore. An attacker holding such a private key, such as a trusted SAML 1.x partner, can forge assertions claiming another partner's issuer and sign in as that partner's users, including privileged ones.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OpenIdentityPlatform | OpenAM | before 16.1.4 | 16.1.4 | Patch available | CNA |
- OpenAM VendorOpenIdentityPlatform Affected before 16.1.4 Fixed in 16.1.4 Patch available CNA
Remediation
Update OpenAM to version 16.1.4, which fixes the issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-08
- Fix · CNA OpenAM (OpenIdentityPlatform) Fixed in 16.1.4
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
OpenIdentityPlatform OpenAM 16.1.4
18 records Highest priority Priority MEDIUM 3 MEDIUM, 15 LOW
Other records, highest priority first
- TI-2026-86693 Session token disclosure in OpenAM notification WebSocketPriority MEDIUM 43
- TI-2026-86692 Authentication bypass in OpenAM SAML login accepts unsigned assertionsPriority MEDIUM 41
- TI-2026-86691 Privilege escalation in OpenAM via self-registration attribute bypassPriority MEDIUM 40
Timeline
- 2026-11-08 Threatist record created from CVE-2026-123538
- 2026-11-08 Alias added: GHSA-9cfm-rxfw-m9h6
- 2026-11-09 Priority changed: MEDIUM → LOW
References
More OpenIdentityPlatform vulnerabilities
- TI-2025-20332 OpenDJ Denial of Service (Dos) using alias loop CVSS 4.0HIGH 8.7
- TI-2026-25836 Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM CVSS 4.0CRITICAL 9.3
- TI-2026-44519 OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback CVSS 3.1CRITICAL 9.8
- TI-2023-19079 User impersonation using SAMLv1.x SSO in Open Access Management CVSS 3.1CRITICAL 9.8
- TI-2026-34275 OpenAM Authentication Bypass via MSISDN LDAP Injection CVSS 4.0CRITICAL 9.3
- TI-2026-32901 OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints CVSS 4.0CRITICAL 9.3
Sources
- CVE-2026-123538 · CVE Program
- CVE-2026-123538 · NVD
- FIRST EPSS
- GHSA-9cfm-rxfw-m9h6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences