CVE-2026-123544

MEDIUM 6.8

OpenAM before 16.1.4 Insufficient Response Validation in Internal SOAP Channel

CVSS Score

6.8

EPSS Score

0.0%

EPSS Percentile

0th

OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal server-to-server SOAP channel, allowing network-positioned attackers to affect integrity and availability. Attackers who intercept unencrypted traffic or control a site server can crash receiving processes, tamper with writable files, and possibly execute code.

CWE	CWE-470
Vendor	openidentityplatform
Product	openam
Published	Nov 8, 2026

Stay Ahead of the Next One

Get instant alerts for openidentityplatform openam

Be the first to know when new medium vulnerabilities affecting openidentityplatform openam are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Affected Versions

OpenIdentityPlatform / OpenAM

0 < 16.1.4

OpenIdentityPlatform / OpenAM

0 < 16.1.4

OpenIdentityPlatform / OpenAM

0 < 16.1.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-6gg2-2v5m-454x vulncheck.com: https://www.vulncheck.com/advisories/openam-before-16.1.4-insufficient-response-validation-in-internal-soap-channel

Credits

🔍 manus-pi vharseko maximthomas tsujiguchitky 🔍 manus-use