{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "OpenAM before 16.1.4: unauthenticated session-token theft, unsigned SAML assertions and self-registration admin takeover (18 advisories, now CVE-2026-123536–123553) · updates",
  "home_page_url": "https://pwn.watch/i/openam-16-1-4-saml-session-token-admin-takeover-cves-nov-2026",
  "feed_url": "https://pwn.watch/i/openam-16-1-4-saml-session-token-admin-takeover-cves-nov-2026/feed.json",
  "description": "Open Identity Platform's OpenAM 16.1.4 (Oct 22) fixes 18 security advisories, three of them critical and unauthenticated. GHSA-5c3q-hp86-xjr8 (CVSS 10.0, OpenAM 14.0.0–16.1.3): live session tokens are broadcast on the agent notification WebSocket (enabled by default) and the WebSocket's auth check can be bypassed through a legacy Liberty ID-FF endpoint, so an unauthenticated attacker can passively collect every user's session token, including administrators', and reuse it against OpenAM and every SSO-protected app. GHSA-3j2f-qhrc-rjfj (CVSS 9.8): an OpenAM SAML v2.0 service provider can accept unsigned assertions on some bindings (ECP/PAOS consumer advertised and WantAssertionsSigned off, both generated defaults, plus an SP encryption key), allowing unauthenticated account takeover. GHSA-jv8f-m88g-h6mm (CVSS 9.8): self-registration (off by default) doesn't enforce the allowed attribute list, so an anonymous user can join an administrative group. GHSA-hvfc-4v4r-8p9w: built-in demo, anonymous and WS-Security/STS agent identities ship with publicly known passwords and can log in; the advisory says this was reported as the entry point of a real intrusion against an outdated deployment. Other fixes cover unauthenticated deserialisation DoS, OAuth 2.0 device-flow CSRF and PKCE bypass, SSRF, open redirects and XSS. VulnCheck assigned CVE-2026-123536 through CVE-2026-123553 on Nov 8. Upgrade to 16.1.4.",
  "language": "en",
  "_pwn": {
    "slug": "openam-16-1-4-saml-session-token-admin-takeover-cves-nov-2026",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/openam-16-1-4-saml-session-token-admin-takeover-cves-nov-2026/feed.xml",
    "llms": "https://pwn.watch/i/openam-16-1-4-saml-session-token-admin-takeover-cves-nov-2026/llms.txt",
    "json": "https://pwn.watch/i/openam-16-1-4-saml-session-token-admin-takeover-cves-nov-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/openam-16-1-4-saml-session-token-admin-takeover-cves-nov-2026#2026-11-08-d3e0496d",
      "url": "https://pwn.watch/i/openam-16-1-4-saml-session-token-admin-takeover-cves-nov-2026#2026-11-08-d3e0496d",
      "title": "OpenAM before 16.1.4: unauthenticated session-token theft, unsigned SAML assertions and self-registration admin takeover (18 advisories, now CVE-2026-123536–123553): VulnCheck assigns CVE-2026-123536 through CVE-2026-123553 to the 18 OpenAM 16.1.4 advisories (CVE-2026-123551 session-token WebSocket, CVE-2026-123550 unsigned SAML assertions, CVE-2026-123549 self-registration admin, CVE-2026-123553 default credentials).",
      "content_text": "OpenAM before 16.1.4: unauthenticated session-token theft, unsigned SAML assertions and self-registration admin takeover (18 advisories, now CVE-2026-123536–123553): VulnCheck assigns CVE-2026-123536 through CVE-2026-123553 to the 18 OpenAM 16.1.4 advisories (CVE-2026-123551 session-token WebSocket, CVE-2026-123550 unsigned SAML assertions, CVE-2026-123549 self-registration admin, CVE-2026-123553 default credentials).\n\nSource: https://www.cve.org/CVERecord?id=CVE-2026-123551",
      "date_published": "2026-11-08T00:00:00.000Z",
      "external_url": "https://www.cve.org/CVERecord?id=CVE-2026-123551",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/openam-16-1-4-saml-session-token-admin-takeover-cves-nov-2026#2026-10-22-8a7c2c3d",
      "url": "https://pwn.watch/i/openam-16-1-4-saml-session-token-admin-takeover-cves-nov-2026#2026-10-22-8a7c2c3d",
      "title": "OpenAM before 16.1.4: unauthenticated session-token theft, unsigned SAML assertions and self-registration admin takeover (18 advisories, now CVE-2026-123536–123553): Open Identity Platform releases OpenAM 16.1.4 and publishes 18 GitHub security advisories, including critical unauthenticated session-token disclosure via the notification WebSocket (CVSS 10.0), unsigned SAML v2.0 assertions accepted by the service provider (9.8) and self-registration admin escalation (9.8). Technical details and PoCs are withheld to give operators time to upgrade.",
      "content_text": "OpenAM before 16.1.4: unauthenticated session-token theft, unsigned SAML assertions and self-registration admin takeover (18 advisories, now CVE-2026-123536–123553): Open Identity Platform releases OpenAM 16.1.4 and publishes 18 GitHub security advisories, including critical unauthenticated session-token disclosure via the notification WebSocket (CVSS 10.0), unsigned SAML v2.0 assertions accepted by the service provider (9.8) and self-registration admin escalation (9.8). Technical details and PoCs are withheld to give operators time to upgrade.\n\nSource: https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-5c3q-hp86-xjr8",
      "date_published": "2026-10-22T00:00:00.000Z",
      "external_url": "https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-5c3q-hp86-xjr8",
      "tags": [
        "critical"
      ]
    }
  ]
}