Answer in brief
CVE-2026-123550 records a Critical severity (CVSS 9.3) vulnerability in OpenAM before 16.1.4 SAML Authentication Bypass via Unsigned Assertions. The current sources do not mark it as known exploited. The current feed maps OpenIdentityPlatform/OpenAM (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps OpenIdentityPlatform/OpenAM (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| OpenIdentityPlatform/OpenAMgeneric | >=0 <16.1.4 | 16.1.4 |
Published upstream
Nov 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 8, 2026
OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts unsigned assertions on the ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false. Unauthenticated remote attackers can submit forged assertions to obtain sessions as any mapped user, including administrators, and hijack single sign-on to dependent applications.
Quoted source text, attributed separately from HOL analysis.