OpenAM versions prior to 16.1.4 include built-in identities with default passwords that are the same across all installations and publicly known. This allows unauthenticated remote attackers to log in as these identities and obtain authenticated sessions. Agent identities can also read configuration data of other agent profiles. The vulnerability is fixed in OpenAM version 16.1.4.
OpenAM versions prior to 16.1.4 contain a server-side request forgery (SSRF) vulnerability in the certificate CRL checking process. This flaw allows an attacker with a trusted CA-chained certificate to make OpenAM fetch certificate revocation lists (CRLs) from arbitrary locations without proper destination restrictions or signature verification. Exploitation can lead to unauthorized internal network requests, credential capture, revocation data manipulation, and denial of certificate authentication.
OpenAM versions from 14.0.0 up to but not including 16.1.4 have an information disclosure vulnerability that allows unauthenticated attackers to read live session tokens via the notification WebSocket. This occurs due to bypassing an agent-only check through an unvalidated internal forward on legacy Liberty ID-FF endpoints, enabling attackers to collect iPlanetDirectoryPro tokens and hijack user and administrator sessions. The vulnerability is critical and has been fixed in version 16.1.4.
OpenAM versions before 16.1.4 have an authentication bypass vulnerability in the SAML v2.0 service provider. This flaw allows unauthenticated remote attackers to submit forged unsigned assertions via ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false, enabling them to impersonate any mapped user, including administrators, and hijack single sign-on sessions.
OpenAM versions prior to 16.1.4 contain a privilege management vulnerability that allows anonymous attackers to bypass attribute restrictions during self-registration. This flaw enables attackers to assign themselves to administrative groups via legacy self-service REST endpoints or the User Self-Service flow, resulting in full administrative control over OpenAM.
OpenIdentityPlatform OpenAM versions before 16.1.4 contain an open redirect vulnerability. This occurs because certain logout and authentication pages do not validate destination URLs against allowed lists, allowing attackers to craft links that redirect users to arbitrary external sites. The vulnerability has a low CVSS score and is fixed in version 16.1.4.
OpenAM versions prior to 16.1.4 contain an open redirect vulnerability due to improper validation of the RelayState parameter when no relayStateUrlList is configured. This flaw allows attackers to craft single sign-on links that redirect users from the trusted OpenAM origin to external malicious sites, potentially facilitating phishing attacks. The vulnerability has a low CVSS score of 2.3 and was fixed in version 16.1.4.
OpenAM versions before 16.1.4 contain an open redirect and cross-site scripting (XSS) vulnerability. This flaw allows remote attackers to manipulate post-login and logout redirection destinations via the 'goto' and 'gotoOnFail' parameters. Exploitation can lead to redirecting users to phishing sites or executing scripts in the XUI interface to steal session cookies. The vulnerability is fixed in OpenAM version 16.1.4.
OpenAM versions from 14.5.1 up to but not including 16.1.4 contain a cross-site request forgery (CSRF) vulnerability in the OAuth 2.0 device authorization flow. This flaw allows attackers to trick logged-in users into approving device codes without explicit consent for implied-consent clients, potentially granting attackers access and ID tokens to act as the user.
CVE-2026-123544 is a vulnerability in OpenAM versions before 16.1.4 and its client SDK, where insufficient validation of responses on the internal server-to-server SOAP channel allows attackers positioned on the network to impact system integrity and availability. Exploitation can lead to process crashes, tampering with writable files, and potential code execution.
OpenAM versions prior to 16.1.4 contain a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending serialized Java data without size or structure limits. This can disrupt authentication, session validation, and policy decision processes.
OpenAM versions prior to 16.1.4 do not enforce the PKCE security mechanism in the OAuth 2.0 device authorization flow. Specifically, the code verifier is never validated when exchanging device codes for tokens. This flaw allows attackers who obtain a valid device code from client logs or shared device storage to redeem it for access and ID tokens, enabling user impersonation.
OpenAM versions prior to 16.1.4 contain an open redirect vulnerability that allows remote attackers to redirect users to attacker-controlled sites after SAML 1.x single sign-on. This occurs due to loose matching of trusted partner destinations, enabling crafted links to redirect authenticated users to phishing sites.
OpenAM versions before 16.1.4 have an output encoding vulnerability that allows a SAML 1.x identity provider to inject unencoded content into the service provider's auto-submitted form. This can lead to altered attribute values received by the application, compromising attribute integrity. The issue is fixed in version 16.1.4.
OpenAM versions before 16.1.4 contain a stored cross-site scripting (XSS) vulnerability. Privileged attackers can inject malicious script into a user's display name. When a victim views the OAuth 2.0 / OpenID Connect consent page, the injected script executes and can steal the victim's OpenAM session cookie, enabling user impersonation. This vulnerability is fixed in OpenAM version 16.1.4.
OpenAM versions prior to 16.1.4 contain a vulnerability where SAML 1.x assertions or responses are not properly verified to ensure the signature matches the claimed issuer. This allows an attacker with access to any private key in OpenAM's keystore to forge assertions impersonating other trusted partners, including privileged users.
OpenAM versions before 16.1.4 contain a server-side request forgery (SSRF) vulnerability. This flaw allows attackers registering UMA resource sets to specify scope description URLs that trigger internal HTTP requests. These requests can target internal hosts or cloud metadata endpoints when OpenAM sends pending-request notification emails, enabling internal network probing. The vulnerability is fixed in version 16.1.4.
OpenAM versions prior to 16.1.4 contain a server-side request forgery (SSRF) vulnerability that allows administrators, including delegated realm administrators, to cause the server to fetch arbitrary URLs via federation configuration wizard metadata URLs. This can be exploited to probe internal network resources or cloud metadata endpoints and read partial responses.
OpenIdentityPlatform OpenAM versions prior to 16.0.6 contain a critical deserialization vulnerability (CWE-502) that allows unauthenticated remote code execution. The flaw arises from unsafe Java deserialization of the jato.clientSession HTTP parameter, bypassing previous mitigations applied to a similar parameter. An attacker can exploit this by sending a crafted serialized Java object to specific endpoints using JATO ViewBean JSPs, such as password reset pages. This vulnerability is fixed in version 16.0.6.