#OpenAM

OpenAM before 16.1.4: unauthenticated session-token theft, unsigned SAML assertions and self-registration admin takeover (18 advisories, now CVE-2026-123536–123553)

Open Identity Platform's OpenAM 16.1.4 (Oct 22) fixes 18 security advisories, three of them critical and unauthenticated. GHSA-5c3q-hp86-xjr8 (CVSS 10.0, OpenAM 14.0.0–16.1.3): live session tokens are broadcast on the agent notification WebSocket (enabled by default) and the WebSocket's auth check can be bypassed through a legacy Liberty ID-FF endpoint, so an unauthenticated attacker can passively collect every user's session token, including administrators', and reuse it against OpenAM and every SSO-protected app. GHSA-3j2f-qhrc-rjfj (CVSS 9.8): an OpenAM SAML v2.0 service provider can accept unsigned assertions on some bindings (ECP/PAOS consumer advertised and WantAssertionsSigned off, both generated defaults, plus an SP encryption key), allowing unauthenticated account takeover. GHSA-jv8f-m88g-h6mm (CVSS 9.8): self-registration (off by default) doesn't enforce the allowed attribute list, so an anonymous user can join an administrative group. GHSA-hvfc-4v4r-8p9w: built-in demo, anonymous and WS-Security/STS agent identities ship with publicly known passwords and can log in; the advisory says this was reported as the entry point of a real intrusion against an outdated deployment. Other fixes cover unauthenticated deserialisation DoS, OAuth 2.0 device-flow CSRF and PKCE bypass, SSRF, open redirects and XSS. VulnCheck assigned CVE-2026-123536 through CVE-2026-123553 on Nov 8. Upgrade to 16.1.4.

OpenAM (Open Identity Platform)·Since Oct 22, 2026·updated Nov 8, 2026, 02:05 UTC