Skip to content

org.openidentityplatform.openam:openam-auth-saml2

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

critical9.8
CVE-2026-123550

OpenAM before 16.1.4 SAML Authentication Bypass via Unsigned Assertions

OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts unsigned assertions on the ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false. Unauthenticated remote attackers can submit forged assertions to obtain sessions as any mapped user, including administrators, and hijack single sign-on to dependent applications.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

OpenIdentityPlatform · OpenAM / OpenIdentityPlatform · OpenAM