CVE-2026-123544
MEDIUM
NVD
CVSS Score
6.8
Severity
MEDIUM
Published
Nov 08, 2026
Vendor
unknown
Description
OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal server-to-server SOAP channel, allowing network-positioned attackers to affect integrity and availability. Attackers who intercept unencrypted traffic or control a site server can crash receiving processes, tamper with writable files, and possibly execute code.