CVE-2026-123543

HIGH 7.5

OpenAM before 16.1.4 Unauthenticated DoS via Unbounded Java Deserialisation

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

OpenAM before 16.1.4 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending serialized Java data without size or structure limits. Attackers can send small crafted requests to remote SDK endpoints, classic login pages, or the administration console to block authentication, session validation and policy decisions.

CWE	CWE-770
Vendor	openidentityplatform
Product	openam
Published	Nov 8, 2026

Stay Ahead of the Next One

Get instant alerts for openidentityplatform openam

Be the first to know when new high vulnerabilities affecting openidentityplatform openam are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

OpenIdentityPlatform / OpenAM

0 < 16.1.4

OpenIdentityPlatform / OpenAM

0 < 16.1.4

OpenIdentityPlatform / OpenAM

0 < 16.1.4

OpenIdentityPlatform / OpenAM

0 < 16.1.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-x7wr-5gxg-v833 vulncheck.com: https://www.vulncheck.com/advisories/openam-before-16.1.4-unauthenticated-dos-via-unbounded-java-deserialisation

Credits

🔍 manus-pi vharseko maximthomas tsujiguchitky 🔍 manus-use