CVE-2026-123543 OpenAM before 16.1.4 Unauthenticated DoS via Unbounded Java Deserialisation
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123543?
CVE-2026-123543 is a high-severity vulnerability in OpenIdentityPlatform OpenAM, published on 8 Nov 2026.
Official description
OpenAM before 16.1.4 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending serialized Java data without size or structure limits. Attackers can send small crafted requests to remote SDK endpoints, classic login pages, or the administration console to block authentication, session validation and policy decisions.
Weakness: CWE-770
Which versions are affected by CVE-2026-123543?
How do I fix CVE-2026-123543?
No fix has been published for CVE-2026-123543 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123543 being exploited?
There is no known exploitation of CVE-2026-123543 in the wild and no public exploit code.
Sources
Also known as GHSA-mj2w-95gj-v3w5, GHSA-x7wr-5gxg-v833.