CVE-2023-37471: User impersonation using SAMLv1.x SSO in Open Access Management

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-07-20 · updated 2026-06-17
Weakness: CWE-287

Description

Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security. OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses received as part of the SAMLv1.x Single Sign-On process. Attackers can use this fact to impersonate any OpenAM user, including the administrator, by sending a specially crafted SAML response to the SAMLPOSTProfileServlet servlet. This problem has been patched in OpenAM 14.7.3-SNAPSHOT and later. User unable to upgrade should comment servlet `SAMLPOSTProfileServlet` from their pom file. See the linked GHSA for details.

Affected products

OpenIdentityPlatform OpenAM: before 14.7.3 — fixed in 14.7.3

How to fix

Upgrade to a fixed version: OpenIdentityPlatform OpenAM 14.7.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-37471 or the next vulnerability affects your stack