{"id":"CVE-2026-123544","aliases":[],"cve":{"records":[{"id":"CVE-2026-123544","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-06T00:48:46.280Z","published":"2026-11-08T01:37:50.045Z","modified":"2026-11-12T12:53:17.928Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-08T01:37:50.045Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-12T12:53:17.928Z"}],"references":[{"url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-6gg2-2v5m-454x","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/openam-before-16.1.4-insufficient-response-validation-in-internal-soap-channel","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-470","description":"Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openidentityplatform:openam:*:*:*:*:*:*:*:*","versionEndExcluding":"16.1.4"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openidentityplatform:openam:*:*:*:*:*:*:*:*","versionEndExcluding":"16.1.4"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openidentityplatform:openam:*:*:*:*:*:*:*:*","versionEndExcluding":"16.1.4"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-12T12:52:59.072310Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"OpenAM before 16.1.4 Insufficient Response Validation in Internal SOAP Channel","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal server-to-server SOAP channel, allowing network-positioned attackers to affect integrity and availability. Attackers who intercept unencrypted traffic or control a site server can crash receiving processes, tamper with writable files, and possibly execute code.","score":6.8,"severity":"medium","published":"2026-11-08T01:37:50.045Z","modified":"2026-11-12T12:53:17.928Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"OpenIdentityPlatform","name":"OpenAM","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"16.1.4","versionType":"semver"},{"version":"16.1.4","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.openidentityplatform.openam/openam-shared","packageIdentity":{"ecosystem":"Maven","name":"org.openidentityplatform.openam:openam-shared"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-123544"},{"vendor":"OpenIdentityPlatform","name":"OpenAM","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"16.1.4","versionType":"semver"},{"version":"16.1.4","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.openidentityplatform.openam/openam-clientsdk","packageIdentity":{"ecosystem":"Maven","name":"org.openidentityplatform.openam:openam-clientsdk"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-123544"},{"vendor":"OpenIdentityPlatform","name":"OpenAM","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"16.1.4","versionType":"semver"},{"version":"16.1.4","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.openidentityplatform.openam/openam-server-only","packageIdentity":{"ecosystem":"Maven","name":"org.openidentityplatform.openam:openam-server-only"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-123544"}],"remediation":[],"references":["https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-6gg2-2v5m-454x","https://www.vulncheck.com/advisories/openam-before-16.1.4-insufficient-response-validation-in-internal-soap-channel"],"sources":[{"name":"CVE","id":"CVE-2026-123544","modified":"2026-11-12T12:53:17.928Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-123544"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","score":6.1},{"source":"VulnCheck","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","score":6.8}],"sourceAffected":[],"observedAt":"2026-11-12T19:30:01.314Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:10:31.937Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-08T03:20:32.875Z","attemptedAt":"2026-11-08T03:20:32.875Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-08T03:20:32.807Z","attemptedAt":"2026-11-08T03:20:32.807Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-08T03:20:32.856Z","attemptedAt":"2026-11-08T03:20:32.856Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-08T03:20:32.561Z","attemptedAt":"2026-11-08T03:20:32.561Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-119429","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-119429","modified":"Nov 8, 2026, 1:37:50 AM","score":6.1,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","checkedAt":"2026-11-08T03:20:32.856Z"},{"source":"NVD","id":"CVE-2026-123544","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123544","modified":"2026-11-08T02:16:45.417","score":6.1,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-08T03:20:32.875Z"},{"source":"NVD","id":"CVE-2026-123544","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123544","modified":"2026-11-08T02:16:45.417","score":6.8,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","checkedAt":"2026-11-08T03:20:32.875Z"}],"aiSummary":{"text":"OpenAM before 16.1.4 has insufficient response validation in its internal SOAP channel, potentially allowing attackers to affect integrity and availability. Attackers with network access or server control can crash processes or tamper with files. The impact may include code execution.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-08T02:21:32.189Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-123544"}]}}