CVE-2026-123540 | BDVDB-2026-401897 Detail
OpenIdentityPlatformOpenAM
Description#
OpenAM before 16.1.4 contains an incomplete output encoding vulnerability that allows a SAML 1.x identity provider to alter attribute values by injecting unencoded content into the service provider auto-submitted form. Attackers controlling a trusted identity provider can craft assertion attribute names or values that reach the target application in modified form, undermining the integrity of received attributes.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact low, availability impact none. Attack vector: network.
Weaknesses#
- CWE-116 Improper Encoding or Escaping of Output
References#
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.