CVE WATCH / VULNERABILITY DETAIL
CVE-2026-123540
LOWCVSS 2NVD feed
Published 8 November 2026 · tracked since 8 November 2026
Description
OpenAM before 16.1.4 contains an incomplete output encoding vulnerability that allows a SAML 1.x identity provider to alter attribute values by injecting unencoded content into the service provider auto-submitted form. Attackers controlling a trusted identity provider can craft assertion attribute n
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog