Skip to content

org.openidentityplatform.openam:openam-shared

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

medium6.8
CVE-2026-123544

OpenAM before 16.1.4 Insufficient Response Validation in Internal SOAP Channel

OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal server-to-server SOAP channel, allowing network-positioned attackers to affect integrity and availability. Attackers who intercept unencrypted traffic or control a site server can crash receiving processes, tamper with writable files, and possibly execute code.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

OpenIdentityPlatform · OpenAM / OpenIdentityPlatform · OpenAM
high8.7
CVE-2026-123543

OpenAM before 16.1.4 Unauthenticated DoS via Unbounded Java Deserialisation

OpenAM before 16.1.4 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending serialized Java data without size or structure limits. Attackers can send small crafted requests to remote SDK endpoints, classic login pages, or the administration console to block authentication, session validation and policy decisions.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

OpenIdentityPlatform · OpenAM / OpenIdentityPlatform · OpenAM