CVE-2026-123544 OpenAM before 16.1.4 Insufficient Response Validation in Internal SOAP Channel
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123544?
CVE-2026-123544 is a medium-severity vulnerability in OpenIdentityPlatform OpenAM, published on 8 Nov 2026.
Official description
OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal server-to-server SOAP channel, allowing network-positioned attackers to affect integrity and availability. Attackers who intercept unencrypted traffic or control a site server can crash receiving processes, tamper with writable files, and possibly execute code.
Weakness: CWE-470
Which versions are affected by CVE-2026-123544?
How do I fix CVE-2026-123544?
No fix has been published for CVE-2026-123544 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123544 being exploited?
There is no known exploitation of CVE-2026-123544 in the wild and no public exploit code.
Sources
Also known as GHSA-6gg2-2v5m-454x, GHSA-xv75-9hr2-vf5x.