Threats tagged 'ghsa-9cfm-rxfw-m9h6'

OpenAM versions before 16.1.4 have a vulnerability in the verification of signed SAML 1.x assertions or responses. The software does not ensure that the signature on a SAML assertion or response matches the partner named as its issuer, allowing acceptance of signatures from any certificate in OpenAM's keystore. This flaw enables an attacker with access to a private key of a trusted SAML 1.x partner to forge assertions that impersonate other partners and sign in as their users, including privileged accounts.