CVE-2026-123540

OpenAM versions prior to 16.1.4 are vulnerable to an incomplete output encoding flaw in SAML 1.x Form POST. This vulnerability allows a trusted identity provider to inject unencoded content into a service provider's auto-submitted form, enabling the modification of assertion attribute names or va...