Description
OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts unsigned assertions on the ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false. Unauthenticated remote attackers can submit forged assertions to obtain sessions as any mapped user, including administrators, and hijack single sign-on to dependent applications.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenIdentityPlatform | OpenAM | < 16.1.4 | 16.1.4 |
References
- GitHub Security Advisory (GHSA-3j2f-qhrc-rjfj) vendor-advisory
- VulnCheck Advisory: OpenAM before 16.1.4 SAML Authentication Bypass via Unsigned Assertions third-party-advisory