Is CVE-2026-123538 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123538 being exploited in the wild.

How severe is CVE-2026-123538?

Medium severity, with a CVSS score of 6.6, published 8 November 2026.

Which products and versions are affected?

Open Identity Platform OpenAM before 16.1.4.

How is CVE-2026-123538 attacked?

It is attacked over the network.

Am I affected by CVE-2026-123538?

Check whether you run Open Identity Platform OpenAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123538: OpenAM SAML 1.x signature verification issuer binding bypass

CVE-2026-123538 · Severity: medium · CVSS 6.6 · Published 2026-11-08

OpenAM is an identity management platform that handles single sign-on for enterprise applications using SAML authentication. The vulnerability allows a compromised or malicious SAML partner organization to forge authentication assertions and impersonate other trusted partners, potentially gaining unauthorized access to user accounts including administrative ones. This affects only deployments using SAML 1.x with multiple trusted partners.

Technologies: Open Identity Platform OpenAM. Vendors: Open Identity Platform.

Quick answers

Is CVE-2026-123538 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123538 being exploited in the wild.
How severe is CVE-2026-123538?: Medium severity, with a CVSS score of 6.6, published 8 November 2026.
Which products and versions are affected?: Open Identity Platform OpenAM before 16.1.4.
Is there a fix for CVE-2026-123538?: Yes: fixed in 16.1.4. Until then: Disable SAML 1.x if not in active use by blocking the /SAMLAwareServlet, /SAMLPOSTProfileServlet, and /SAMLSOAPReceiver endpoints at the reverse proxy. Remove certificates from OpenAM's keystore for parties no longer trusted. Pre-upgrade, configure the signing certificate alias for each SAML 1.x partner to minimize post-upgrade disruption. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123538 attacked?: It is attacked over the network.
Am I affected by CVE-2026-123538?: Check whether you run Open Identity Platform OpenAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 16.1.4

Disable SAML 1.x if not in active use by blocking the /SAMLAwareServlet, /SAMLPOSTProfileServlet, and /SAMLSOAPReceiver endpoints at the reverse proxy. Remove certificates from OpenAM's keystore for parties no longer trusted. Pre-upgrade, configure the signing certificate alias for each SAML 1.x partner to minimize post-upgrade disruption.

Technical details

OpenAM fails to bind SAML 1.x signature verification to the issuer's identity, accepting any signature made with any certificate in its keystore rather than validating the signer matches the claimed issuer. An attacker with access to any trusted certificate (typically a SAML partner or via key compromise) can forge SAML assertions claiming to be from a different partner and sign in as that partner's users. The vulnerability requires high privilege (access to a trusted certificate) and high attack complexity but enables account takeover with full confidentiality, integrity, and availability impact.

Affected products

Open Identity Platform OpenAM before 16.1.4

Timeline

2026-10-22: advisory
2026-11-08: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.