# OpenAM before 16.1.4: unauthenticated session-token theft, unsigned SAML assertions and self-registration admin takeover (18 advisories, now CVE-2026-123536–123553) · pwn.watch

> Open Identity Platform's OpenAM 16.1.4 (Oct 22) fixes 18 security advisories, three of them critical and unauthenticated. GHSA-5c3q-hp86-xjr8 (CVSS 10.0, OpenAM 14.0.0–16.1.3): live session tokens are broadcast on the agent notification WebSocket (enabled by default) and the WebSocket's auth check can be bypassed through a legacy Liberty ID-FF endpoint, so an unauthenticated attacker can passively collect every user's session token, including administrators', and reuse it against OpenAM and every SSO-protected app. GHSA-3j2f-qhrc-rjfj (CVSS 9.8): an OpenAM SAML v2.0 service provider can accept unsigned assertions on some bindings (ECP/PAOS consumer advertised and WantAssertionsSigned off, both generated defaults, plus an SP encryption key), allowing unauthenticated account takeover. GHSA-jv8f-m88g-h6mm (CVSS 9.8): self-registration (off by default) doesn't enforce the allowed attribute list, so an anonymous user can join an administrative group. GHSA-hvfc-4v4r-8p9w: built-in demo, anonymous and WS-Security/STS agent identities ship with publicly known passwords and can log in; the advisory says this was reported as the entry point of a real intrusion against an outdated deployment. Other fixes cover unauthenticated deserialisation DoS, OAuth 2.0 device-flow CSRF and PKCE bypass, SSRF, open redirects and XSS. VulnCheck assigned CVE-2026-123536 through CVE-2026-123553 on Nov 8. Upgrade to 16.1.4.

Page: https://pwn.watch/i/openam-16-1-4-saml-session-token-admin-takeover-cves-nov-2026 · generated 2026-11-08T02:39:23.697Z

## Status
- Severity: critical · status: live · patch: patched
- Product: OpenAM (Open Identity Platform)
- Started: 2026-10-22
- CVEs: CVE-2026-123551, CVE-2026-123550, CVE-2026-123549, CVE-2026-123553, CVE-2026-123543, CVE-2026-123545, CVE-2026-123542, CVE-2026-123544, CVE-2026-123538, CVE-2026-123552, CVE-2026-123546, CVE-2026-123537, CVE-2026-123539, CVE-2026-123541, CVE-2026-123547, CVE-2026-123548, CVE-2026-123536, CVE-2026-123540
- Affected: OpenAM <= 16.1.3 (all 18 advisories; session-token WebSocket disclosure affects 14.0.0–16.1.3, OAuth 2.0 device-flow CSRF affects 14.5.1–16.1.3); Applications using the OpenAM client SDK from releases <= 16.1.3 (deserialisation DoS, GHSA-x7wr-5gxg-v833)
- Fixed in: OpenAM 16.1.4

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/openam-16-1-4-saml-session-token-admin-takeover-cves-nov-2026/feed.xml
- JSON Feed: https://pwn.watch/i/openam-16-1-4-saml-session-token-admin-takeover-cves-nov-2026/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/openam-16-1-4-saml-session-token-admin-takeover-cves-nov-2026.json
- This file: https://pwn.watch/i/openam-16-1-4-saml-session-token-admin-takeover-cves-nov-2026/llms.txt

## Updates (newest first)
- 2026-11-08: VulnCheck assigns CVE-2026-123536 through CVE-2026-123553 to the 18 OpenAM 16.1.4 advisories (CVE-2026-123551 session-token WebSocket, CVE-2026-123550 unsigned SAML assertions, CVE-2026-123549 self-registration admin, CVE-2026-123553 default credentials). (https://www.cve.org/CVERecord?id=CVE-2026-123551)
- 2026-10-22: Open Identity Platform releases OpenAM 16.1.4 and publishes 18 GitHub security advisories, including critical unauthenticated session-token disclosure via the notification WebSocket (CVSS 10.0), unsigned SAML v2.0 assertions accepted by the service provider (9.8) and self-registration admin escalation (9.8). Technical details and PoCs are withheld to give operators time to upgrade. (https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-5c3q-hp86-xjr8)

## Fix brief
# Security brief: OpenAM before 16.1.4: unauthenticated session-token theft, unsigned SAML assertions and self-registration admin takeover (18 advisories, now CVE-2026-123536–123553)

Source: https://pwn.watch/i/openam-16-1-4-saml-session-token-admin-takeover-cves-nov-2026 · status: live · severity: critical · updated Nov 8, 2026, 02:05 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Open Identity Platform's OpenAM 16.1.4 (Oct 22) fixes 18 security advisories, three of them critical and unauthenticated. GHSA-5c3q-hp86-xjr8 (CVSS 10.0, OpenAM 14.0.0–16.1.3): live session tokens are broadcast on the agent notification WebSocket (enabled by default) and the WebSocket's auth check can be bypassed through a legacy Liberty ID-FF endpoint, so an unauthenticated attacker can passively collect every user's session token, including administrators', and reuse it against OpenAM and every SSO-protected app. GHSA-3j2f-qhrc-rjfj (CVSS 9.8): an OpenAM SAML v2.0 service provider can accept unsigned assertions on some bindings (ECP/PAOS consumer advertised and WantAssertionsSigned off, both generated defaults, plus an SP encryption key), allowing unauthenticated account takeover. GHSA-jv8f-m88g-h6mm (CVSS 9.8): self-registration (off by default) doesn't enforce the allowed attribute list, so an anonymous user can join an administrative group. GHSA-hvfc-4v4r-8p9w: built-in demo, anonymous and WS-Security/STS agent identities ship with publicly known passwords and can log in; the advisory says this was reported as the entry point of a real intrusion against an outdated deployment. Other fixes cover unauthenticated deserialisation DoS, OAuth 2.0 device-flow CSRF and PKCE bypass, SSRF, open redirects and XSS. VulnCheck assigned CVE-2026-123536 through CVE-2026-123553 on Nov 8. Upgrade to 16.1.4.

Severity detail: Three critical unauthenticated advisories: GHSA-5c3q-hp86-xjr8 / CVE-2026-123551 CVSS 3.1 10.0 (session-token disclosure via notification WebSocket), GHSA-3j2f-qhrc-rjfj / CVE-2026-123550 9.8 (unsigned SAML assertions accepted), GHSA-jv8f-m88g-h6mm / CVE-2026-123549 9.8 (self-registration admin escalation; only realms with self-registration enabled). Default-credentials advisory GHSA-hvfc-4v4r-8p9w reported as the entry point of a real intrusion.

- Product: OpenAM (Open Identity Platform)
- CVE / advisory ids: CVE-2026-123551, CVE-2026-123550, CVE-2026-123549, CVE-2026-123553, CVE-2026-123543, CVE-2026-123545, CVE-2026-123542, CVE-2026-123544, CVE-2026-123538, CVE-2026-123552, CVE-2026-123546, CVE-2026-123537, CVE-2026-123539, CVE-2026-123541, CVE-2026-123547, CVE-2026-123548, CVE-2026-123536, CVE-2026-123540

## Affected versions
- OpenAM <= 16.1.3 (all 18 advisories; session-token WebSocket disclosure affects 14.0.0–16.1.3, OAuth 2.0 device-flow CSRF affects 14.5.1–16.1.3)
- Applications using the OpenAM client SDK from releases <= 16.1.3 (deserialisation DoS, GHSA-x7wr-5gxg-v833)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- OpenAM 16.1.4

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Specific notes
Upgrade every OpenAM server (and apps embedding the OpenAM client SDK) to 16.1.4; all 18 advisories affect releases up to 16.1.3. The session-token WebSocket flaw needs only network reach to the OpenAM port and agent notifications are on by default, so treat exposed pre-16.1.4 servers as possibly compromised: invalidate sessions after upgrading. Remove or re-password the built-in demo, anonymous, wsc, wsp, SecurityTokenService and agentAuth identities (GHSA-hvfc-4v4r-8p9w). If OpenAM is a SAML v2.0 SP, turning on Assertions Signed (WantAssertionsSigned) matters for GHSA-3j2f-qhrc-rjfj; self-registration realms are exposed to GHSA-jv8f-m88g-h6mm. See each advisory's Workarounds section before relying on anything other than the upgrade.

## Latest updates
- Nov 8, 2026: VulnCheck assigns CVE-2026-123536 through CVE-2026-123553 to the 18 OpenAM 16.1.4 advisories (CVE-2026-123551 session-token WebSocket, CVE-2026-123550 unsigned SAML assertions, CVE-2026-123549 self-registration admin, CVE-2026-123553 default credentials).
- Oct 22, 2026: Open Identity Platform releases OpenAM 16.1.4 and publishes 18 GitHub security advisories, including critical unauthenticated session-token disclosure via the notification WebSocket (CVSS 10.0), unsigned SAML v2.0 assertions accepted by the service provider (9.8) and self-registration admin escalation (9.8). Technical details and PoCs are withheld to give operators time to upgrade.

## Advisories
- [GHSA-5c3q-hp86-xjr8: unauthenticated disclosure of live session tokens via the notification WebSocket](https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-5c3q-hp86-xjr8) (OpenIdentityPlatform/OpenAM)
- [GHSA-3j2f-qhrc-rjfj: SAML v2.0 service provider accepts unsigned assertions on some bindings](https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-3j2f-qhrc-rjfj) (OpenIdentityPlatform/OpenAM)
- [GHSA-jv8f-m88g-h6mm: self-registration lets an anonymous user create an administrator account](https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-jv8f-m88g-h6mm) (OpenIdentityPlatform/OpenAM)
- [GHSA-hvfc-4v4r-8p9w: built-in accounts with publicly known passwords allow unauthenticated login](https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-hvfc-4v4r-8p9w) (OpenIdentityPlatform/OpenAM)
- [GHSA-x7wr-5gxg-v833: unauthenticated DoS through unbounded deserialisation](https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-x7wr-5gxg-v833) (OpenIdentityPlatform/OpenAM)
- [GHSA-545c-rm35-2jj2: CSRF in the OAuth 2.0 device flow](https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-545c-rm35-2jj2) (OpenIdentityPlatform/OpenAM)
- [OpenAM security advisories (all 18 fixed in 16.1.4)](https://github.com/OpenIdentityPlatform/OpenAM/security/advisories) (OpenIdentityPlatform/OpenAM)
- [OpenAM 16.1.4 release](https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.4) (OpenIdentityPlatform/OpenAM)
- [CVE-2026-123551 record (VulnCheck CNA)](https://www.cve.org/CVERecord?id=CVE-2026-123551) (CVE.org)
- [CVE-2026-123550 record (VulnCheck CNA)](https://www.cve.org/CVERecord?id=CVE-2026-123550) (CVE.org)
- [VulnCheck: OpenAM 14.0.0 before 16.1.4 session token disclosure via notification WebSocket](https://www.vulncheck.com/advisories/openam-14.0.0-before-16.1.4-session-token-disclosure-via-notification-websocket) (VulnCheck)

---
Machine-readable: https://pwn.watch/i/openam-16-1-4-saml-session-token-admin-takeover-cves-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.