OpenAM before 16.1.4: unauthenticated session-token theft, unsigned SAML assertions and self-registration admin takeover (18 advisories, now CVE-2026-123536–123553)

Open Identity Platform's OpenAM 16.1.4 (Oct 22) fixes 18 security advisories, three of them critical and unauthenticated. GHSA-5c3q-hp86-xjr8 (CVSS 10.0, OpenAM 14.0.0–16.1.3): live session tokens are broadcast on the agent notification WebSocket (enabled by default) and the WebSocket's auth check can be bypassed through a legacy Liberty ID-FF endpoint, so an unauthenticated attacker can passively collect every user's session token, including administrators', and reuse it against OpenAM and every SSO-protected app. GHSA-3j2f-qhrc-rjfj (CVSS 9.8): an OpenAM SAML v2.0 service provider can accept unsigned assertions on some bindings (ECP/PAOS consumer advertised and WantAssertionsSigned off, both generated defaults, plus an SP encryption key), allowing unauthenticated account takeover. GHSA-jv8f-m88g-h6mm (CVSS 9.8): self-registration (off by default) doesn't enforce the allowed attribute list, so an anonymous user can join an administrative group. GHSA-hvfc-4v4r-8p9w: built-in demo, anonymous and WS-Security/STS agent identities ship with publicly known passwords and can log in; the advisory says this was reported as the entry point of a real intrusion against an outdated deployment. Other fixes cover unauthenticated deserialisation DoS, OAuth 2.0 device-flow CSRF and PKCE bypass, SSRF, open redirects and XSS. VulnCheck assigned CVE-2026-123536 through CVE-2026-123553 on Nov 8. Upgrade to 16.1.4.

Why this severity: Three critical unauthenticated advisories: GHSA-5c3q-hp86-xjr8 / CVE-2026-123551 CVSS 3.1 10.0 (session-token disclosure via notification WebSocket), GHSA-3j2f-qhrc-rjfj / CVE-2026-123550 9.8 (unsigned SAML assertions accepted), GHSA-jv8f-m88g-h6mm / CVE-2026-123549 9.8 (self-registration admin escalation; only realms with self-registration enabled). Default-credentials advisory GHSA-hvfc-4v4r-8p9w reported as the entry point of a real intrusion.

Started

Oct 22, 2026

CVEs

CVE-2026-123551CVE-2026-123550CVE-2026-123549CVE-2026-123553CVE-2026-123543CVE-2026-123545CVE-2026-123542CVE-2026-123544CVE-2026-123538CVE-2026-123552CVE-2026-123546CVE-2026-123537CVE-2026-123539CVE-2026-123541CVE-2026-123547CVE-2026-123548CVE-2026-123536CVE-2026-123540

• Java
• #OpenAM
• #Open Identity Platform
• #SSO
• #SAML
• #OAuth
• Auth bypass
• #Account takeover
• #Session Hijacking
• #Privilege escalation
• #Default Credentials
• #WebSocket
• #DoS