Medium severity6.8NVD Advisory· Published Nov 8, 2026

CVE-2026-123544

Description

OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal server-to-server SOAP channel, allowing network-positioned attackers to affect integrity and availability. Attackers who intercept unencrypted traffic or control a site server can crash receiving processes, tamper with writable files, and possibly execute code.

Affected products

Openidentityplatform/Openamllm-fuzzy
Range: <16.1.4
Openidentityplatform/OpenAM client SDKllm-create
Range: <16.1.4

Patches

Vulnerability mechanics

References

github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-6gg2-2v5m-454xnvd
www.vulncheck.com/advisories/openam-before-16.1.4-insufficient-response-validation-in-internal-soap-channelnvd

News mentions

No linked articles in our index yet.

cvss	0.442
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000