OpenAM before 16.1.4: unauthenticated session-token theft, unsigned SAML assertions and self-registration admin takeover (18 advisories, now CVE-2026-123536–123553) · updates https://pwn.watch/i/openam-16-1-4-saml-session-token-admin-takeover-cves-nov-2026 Open Identity Platform's OpenAM 16.1.4 (Oct 22) fixes 18 security advisories, three of them critical and unauthenticated. GHSA-5c3q-hp86-xjr8 (CVSS 10.0, OpenAM 14.0.0–16.1.3): live session tokens are broadcast on the agent notification WebSocket (enabled by default) and the WebSocket's auth check can be bypassed through a legacy Liberty ID-FF endpoint, so an unauthenticated attacker can passively collect every user's session token, including administrators', and reuse it against OpenAM and every SSO-protected app. GHSA-3j2f-qhrc-rjfj (CVSS 9.8): an OpenAM SAML v2.0 service provider can accept unsigned assertions on some bindings (ECP/PAOS consumer advertised and WantAssertionsSigned off, both generated defaults, plus an SP encryption key), allowing unauthenticated account takeover. GHSA-jv8f-m88g-h6mm (CVSS 9.8): self-registration (off by default) doesn't enforce the allowed attribute list, so an anonymous user can join an administrative group. GHSA-hvfc-4v4r-8p9w: built-in demo, anonymous and WS-Security/STS agent identities ship with publicly known passwords and can log in; the advisory says this was reported as the entry point of a real intrusion against an outdated deployment. Other fixes cover unauthenticated deserialisation DoS, OAuth 2.0 device-flow CSRF and PKCE bypass, SSRF, open redirects and XSS. VulnCheck assigned CVE-2026-123536 through CVE-2026-123553 on Nov 8. Upgrade to 16.1.4. en Sun, 08 Nov 2026 00:00:00 GMT OpenAM before 16.1.4: unauthenticated session-token theft, unsigned SAML assertions and self-registration admin takeover (18 advisories, now CVE-2026-123536–123553): VulnCheck assigns CVE-2026-123536 through CVE-2026-123553 to the 18 OpenAM 16.1.4 advisories (CVE-2026-123551 session-token WebSocket, CVE-2026-123550 unsigned SAML assertions, CVE-2026-123549 self-registration admin, CVE-2026-123553 default credentials). https://pwn.watch/i/openam-16-1-4-saml-session-token-admin-takeover-cves-nov-2026 https://pwn.watch/i/openam-16-1-4-saml-session-token-admin-takeover-cves-nov-2026#2026-11-08-d3e0496d Sun, 08 Nov 2026 00:00:00 GMT critical <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-123551">Source</a></p> OpenAM before 16.1.4: unauthenticated session-token theft, unsigned SAML assertions and self-registration admin takeover (18 advisories, now CVE-2026-123536–123553): Open Identity Platform releases OpenAM 16.1.4 and publishes 18 GitHub security advisories, including critical unauthenticated session-token disclosure via the notification WebSocket (CVSS 10.0), unsigned SAML v2.0 assertions accepted by the service provider (9.8) and self-registration admin escalation (9.8). Technical details and PoCs are withheld to give operators time to upgrade. https://pwn.watch/i/openam-16-1-4-saml-session-token-admin-takeover-cves-nov-2026 https://pwn.watch/i/openam-16-1-4-saml-session-token-admin-takeover-cves-nov-2026#2026-10-22-8a7c2c3d Thu, 22 Oct 2026 00:00:00 GMT critical <p><a href="https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-5c3q-hp86-xjr8">Source</a></p>