Answer in brief
CVE-2026-123538 records a High severity (CVSS 7.5) vulnerability in OpenAM before 16.1.4 SAML 1.x Signature Verification Issuer Impersonation. The current sources do not mark it as known exploited. The current feed maps OpenIdentityPlatform/OpenAM (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps OpenIdentityPlatform/OpenAM (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| OpenIdentityPlatform/OpenAMgeneric | >=0 <16.1.4 | 16.1.4 |
Published upstream
Nov 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 8, 2026
OpenAM before 16.1.4 does not verify that a signed SAML 1.x assertion or response was signed by the partner named as its issuer, accepting a signature from any certificate in OpenAM's keystore. An attacker holding such a private key, such as a trusted SAML 1.x partner, can forge assertions claiming another partner's issuer and sign in as that partner's users, including privileged ones.
Quoted source text, attributed separately from HOL analysis.