CVE-2026-123543: OpenAM denial of service in Java deserialization

CVE-2026-123543 · Severity: high · CVSS 7.5 · Published 2026-11-08

OpenAM is an identity and access management platform that handles authentication and authorization for enterprise applications. An unauthenticated attacker can send specially crafted requests to overwhelm the server's CPU and memory, blocking all logins and authentication checks across dependent applications. The vulnerability affects remote SDK endpoints, login pages, and the administration console and can be exploited with minimal network traffic.

Technologies: OpenIdentityPlatform OpenAM. Vendors: OpenIdentityPlatform.

Quick answers

Is CVE-2026-123543 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-123543 being exploited in the wild.
How severe is CVE-2026-123543?
High severity, with a CVSS score of 7.5, published 8 November 2026.
Which products and versions are affected?
OpenIdentityPlatform OpenAM up to and including 16.1.3; OpenIdentityPlatform OpenAM Client SDK up to and including 16.1.3.
Is there a fix for CVE-2026-123543?
Yes: fixed in 16.1.4. Until then: Restrict network access to legacy remote SDK endpoints (/sessionservice, /authservice, PLL and JAX-RPC endpoints) at the reverse proxy or firewall to only authorized hosts running policy agents and SDK clients. Additionally, limit request size and rate for affected endpoints at the reverse proxy, restrict console access to administrator networks, and run multiple OpenAM servers behind a load balancer with health checks to remove overloaded instances. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123543 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-123543?
Check whether you run OpenIdentityPlatform OpenAM or OpenIdentityPlatform OpenAM Client SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 16.1.4

Restrict network access to legacy remote SDK endpoints (/sessionservice, /authservice, PLL and JAX-RPC endpoints) at the reverse proxy or firewall to only authorized hosts running policy agents and SDK clients. Additionally, limit request size and rate for affected endpoints at the reverse proxy, restrict console access to administrator networks, and run multiple OpenAM servers behind a load balancer with health checks to remove overloaded instances.

Technical details

The vulnerability is an uncontrolled resource consumption issue (CWE-400, CWE-502) in Java deserialization endpoints that lack size and structure limits. Unauthenticated attackers can send small serialized Java payloads to legacy SDK interfaces (/sessionservice, /authservice), classic login pages, and the administration console to exhaust CPU or memory. No code execution or data disclosure occurs, but availability is completely compromised.

Affected products

  • OpenIdentityPlatform OpenAM up to and including 16.1.3
  • OpenIdentityPlatform OpenAM Client SDK up to and including 16.1.3

Timeline

  • 2026-10-22: disclosed
  • 2026-10-22: patched: OpenAM 16.1.4 released
  • 2026-11-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.