Advisory · CVE-2026-123543
OpenAM can be knocked offline by unauthenticated serialized-data floods
OpenAM before 16.1.4 lets unauthenticated attackers exhaust server resources by sending serialized Java data without size or structure limits to remote SDK endpoints, classic login pages, or the administration console, rated high at CVSS 8.7 under version 4.0; fixed in 16.1.4.
- Vendor
- OpenIdentityPlatform
- Product
- OpenAM
- Identifier / CWE
- CVE-2026-123543
CWE-770 - Action timing
- Immediate
Explain it like I’m five
OpenAM accepts parcels of Java data from strangers without checking how big or tangled they are. A flood of small crafted parcels ties up the server until logins and admin work grind to a halt.
- 01Crafted request sent
A small serialized Java payload is sent to a remote SDK endpoint, a classic login page, or the administration console.
- 02No size limits
The data is processed without size or structure bounds.
- 03Resources consumed
Server threads and memory are tied up deserializing the payloads.
- 04Authentication stalls
Logins, session validation, and policy decisions block until resources free up.
What happened
OpenAM before 16.1.4 contains a denial of service flaw that allows unauthenticated attackers to exhaust server resources by sending serialized Java data without size or structure limits. Attackers can send small crafted requests to remote SDK endpoints, classic login pages, or the administration console to block authentication, session validation, and policy decisions. The record rates it high at CVSS 8.7 under version 4.0, with network attack vector, low complexity, no privileges required, and no user interaction.
The attack needs no account and the requests are small, so it is cheap to run and hard to spot in normal traffic. The flaw is fixed in OpenAM 16.1.4.
What to do
- Inventory OpenAM deployments and record each version.
- Upgrade to OpenAM 16.1.4 or later.
- Until upgraded, restrict network access to SDK endpoints, login pages, and the administration console to trusted sources where possible.
- Monitor for spikes in serialized-data requests and for authentication latency.
- Verify the deployed version after updating.
Management note
An outage in the identity platform is an outage everywhere downstream. This one costs the attacker almost nothing, so treat the patch as availability work, not just security work.