OpenAM 16.1.4 fixes critical SSO account takeover flaws

Four advisories cover OpenAM 16.1.3 and earlier. Three are rated critical. All are fixed in OpenAM 16.1.4. Exploitation in the wild: not reported in any of the advisories.

OpenAM is a central authentication service. A compromised instance exposes every application that relies on it for single sign-on. Maintainers published the advisories on Oct 22, 2026 and are withholding technical details to give operators time to upgrade.

What is affected

SAML assertion acceptance. Per the maintainer advisory, a hosted SAML v2.0 service provider may accept an assertion that the identity provider never signed, then issue a session for the user it names. Rated critical. Three conditions must hold together: the ECP (PAOS) assertion consumer service is advertised (default), WantAssertionsSigned is off (default), and an encryption key is configured (an administrator choice, not default). The advisory states administrator accounts are not excluded. Deployments that do not act as a SAML v2.0 service provider are not affected.

Session token disclosure. Per the advisory, an unauthenticated network attacker can read live session tokens from the notification WebSocket. Rated critical. Affects versions 14.0.0 through 16.1.3. The advisory says agent notifications are on by default and that a captured administrator session can lead to configuration takeover and command execution as the OpenAM service account. It describes collection as passive, with no failed logins to alert on.

Self-registration. Per the advisory, self-registration does not enforce the allowed attribute list, so an anonymous user can join any existing group, including administrative ones. Rated critical. Only realms with self-registration enabled are affected. It is off by default.

Denial of service. Per the advisory, unbounded deserialisation on remote SDK and console endpoints lets an unauthenticated client exhaust CPU or memory. Rated high. No code execution on a default install and no data disclosure, per the advisory.

What to do

Upgrade to OpenAM 16.1.4. Upgrade notes from the advisories:

• Service providers will refuse unsigned assertions from partners after the upgrade (assertionNotSigned). That includes OpenAM-to-OpenAM and Fedlet federation over HTTP-Artifact on default settings.
• Registration requests carrying attributes outside Valid Creation Attributes are refused. mail must stay in the list.

Interim workarounds from the advisories:

• Disable self-registration in realms that do not need it, in both the User Self-Service and legacy settings.
• Review group memberships of accounts created through self-registration.
• Restrict network access to legacy remote SDK endpoints and the administration console.

The advisories state administrative and agent-facing endpoints should not be exposed to the public internet.

Confidence

Advisory contents: confirmed, from the maintainer’s own pages. Exploitation status: unconfirmed, nothing in the sources reports it. Analysis: given the advisories are public and fixes shipped, expect interest in diffing 16.1.4 against earlier builds. That is a judgment, not a reported fact.