External risk intelligence

OpenAM SAML Authentication Bypass via Unsigned Assertions

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-123550

OpenAM is an identity and access management solution frequently deployed as a public-facing identity provider or SSO gateway to facilitate authentication across external and internal applications. Its role in processing SAML assertions at the edge makes it a core internet-facing component by design.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the SAML 2.0 service provider of OpenAM, specifically in how it handles unsigned assertions, allows unauthenticated attackers to bypass authentication and potentially gain administrative access or hijack single sign-on sessions to dependent applications. This issue matters because it could compromise user accounts and access to sensitive systems.

Bypass authentication to gain unauthorized access.
Potential for session hijacking and data access.
Verify if OpenAM is deployed and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can bypass authentication by sending forged SAML assertions to the SAML v2.0 service provider. This is possible when the service provider is configured to accept unsigned assertions via the ECP (PAOS) or HTTP-Artifact bindings. By exploiting this, an attacker can impersonate any user, including administrators, and gain unauthorized single sign-on access to connected applications.

No authentication required.
Submit forged unsigned assertions.
Session hijacking and unauthorized access.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow unauthenticated remote attackers to bypass authentication mechanisms in OpenAM's SAML v2.0 service provider. This could lead to unauthorized session creation for any mapped user, potentially including administrators, and subsequent hijacking of single sign-on to connected applications.

System data and user accounts are at risk.
Attackers submit forged SAML assertions.
Unauthorized access and session hijacking may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

The critical authentication bypass vulnerability in OpenAM's SAML v2.0 service provider requires immediate attention from teams managing identity and access management (IAM) infrastructure. The first practical move is to inventory all OpenAM deployments, confirm their exposure to the internet, and identify the business-critical applications they protect. Once accountable owners are established, a risk-based remediation plan can be formulated, potentially involving vendor coordination for patching or the implementation of compensating controls if immediate patching is not feasible.

IAM and infrastructure teams own remediation.
Verify internet-facing OpenAM instances.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpenAM?

OpenAM is an identity and access management platform used to centralize user authentication and authorization. It acts as an identity provider or single sign-on (SSO) gateway, allowing users to log in once to access a wide array of internal and external applications. By managing these digital identities at the edge, it serves as a critical gatekeeper for enterprise access control.

What does CWE-290 mean for CVE-2026-123550?

CWE-290 refers to Authentication Bypass by Spoofing. In the context of CVE-2026-123550, this means the software incorrectly trusts incoming identity data. Because the system may accept unsigned SAML assertions, an attacker can manipulate or forge these assertions to trick the service into believing they are a legitimate, authenticated user, including those with administrative privileges.

How do attackers trigger this OpenAM vulnerability?

An attacker triggers the vulnerability by submitting a forged SAML assertion to the SAML v2.0 service provider. This attack path relies on specific configurations where the system is set to accept unsigned assertions via ECP or HTTP-Artifact bindings. Importantly, this bug is not triggered if the service is correctly configured to enforce signed assertions, as that forces the system to cryptographically verify the origin of the identity data.

Do I need to worry about this if my OpenAM instance is internal?

According to Halo Surface Signal, OpenAM is often deployed as a public-facing gateway, making it a frequent target for network-based attacks. While internet-facing instances are at the highest risk, the vulnerability still poses a threat if an attacker reaches your internal network. You should prioritize assessing the exposure of any OpenAM instance that handles sensitive SAML traffic, regardless of its network placement.

When should I take action against this CVE?

You should take action immediately by identifying all OpenAM instances in your environment. Since this vulnerability allows unauthorized access to administrative sessions, the first step is to verify your current configuration settings regarding assertion signing. Coordinate with your infrastructure and IAM teams to ensure your deployments are updated to version 16.1.4 or higher to resolve the underlying logic flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.