Insufficient response validation in OpenAM internal SOAP channel
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
OpenAM before 16.1.4 and its client SDK do not sufficiently validate responses on the internal server-to-server SOAP channel. A network-positioned attacker who intercepts unencrypted traffic or controls a site server can crash receiving processes, tamper with writable files and possibly execute code, affecting integrity and availability. The flaw is classified as CWE-470.
Written with Claude Haiku 5.5 from the sources below · 2026-11-08
Description from the CNA
OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal server-to-server SOAP channel, allowing network-positioned attackers to affect integrity and availability. Attackers who intercept unencrypted traffic or control a site server can crash receiving processes, tamper with writable files, and possibly execute code.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OpenIdentityPlatform | OpenAM | before 16.1.4 | 16.1.4 | Patch available | CNA |
| OpenIdentityPlatform | OpenAM | before 16.1.4 | 16.1.4 | Patch available | CNA |
| OpenIdentityPlatform | OpenAM | before 16.1.4 | 16.1.4 | Patch available | CNA |
- OpenAM VendorOpenIdentityPlatform Affected before 16.1.4 Fixed in 16.1.4 Patch available CNA
- OpenAM VendorOpenIdentityPlatform Affected before 16.1.4 Fixed in 16.1.4 Patch available CNA
- OpenAM VendorOpenIdentityPlatform Affected before 16.1.4 Fixed in 16.1.4 Patch available CNA
Remediation
Upgrade OpenAM to version 16.1.4, which fixes the flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-11-08
- Fix · CNA OpenAM (OpenIdentityPlatform) Fixed in 16.1.4
- Fix · CNA OpenAM (OpenIdentityPlatform) Fixed in 16.1.4
- Fix · CNA OpenAM (OpenIdentityPlatform) Fixed in 16.1.4
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
OpenIdentityPlatform OpenAM 16.1.4
18 records Highest priority Priority MEDIUM 3 MEDIUM, 15 LOW
Other records, highest priority first
- TI-2026-86693 Session token disclosure in OpenAM notification WebSocketPriority MEDIUM 43
- TI-2026-86692 Authentication bypass in OpenAM SAML login accepts unsigned assertionsPriority MEDIUM 41
- TI-2026-86691 Privilege escalation in OpenAM via self-registration attribute bypassPriority MEDIUM 40
Timeline
- 2026-11-08 Threatist record created from CVE-2026-123544
- 2026-11-08 Alias added: GHSA-xv75-9hr2-vf5x
- 2026-11-09 Priority changed: MEDIUM → LOW
References
More OpenIdentityPlatform vulnerabilities
- TI-2025-20332 OpenDJ Denial of Service (Dos) using alias loop CVSS 4.0HIGH 8.7
- TI-2026-25836 Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM CVSS 4.0CRITICAL 9.3
- TI-2026-44519 OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback CVSS 3.1CRITICAL 9.8
- TI-2023-19079 User impersonation using SAMLv1.x SSO in Open Access Management CVSS 3.1CRITICAL 9.8
- TI-2026-34275 OpenAM Authentication Bypass via MSISDN LDAP Injection CVSS 4.0CRITICAL 9.3
- TI-2026-32901 OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints CVSS 4.0CRITICAL 9.3
Sources
- CVE-2026-123544 · CVE Program
- CVE-2026-123544 · NVD
- FIRST EPSS
- GHSA-xv75-9hr2-vf5x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences