What is GHSA-xv75-9hr2-vf5x?

GHSA-xv75-9hr2-vf5x is a security advisory published by GitHub Security Advisories with Medium severity. OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal...

Which CVE IDs does GHSA-xv75-9hr2-vf5x cover?

GHSA-xv75-9hr2-vf5x covers the following CVE IDs: CVE-2026-123544. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xv75-9hr2-vf5x?

GHSA-xv75-9hr2-vf5x has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

GHSA-xv75-9hr2-vf5xMediumCVSS 6.8

OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal...

Vendor

GitHub Security Advisories

Published

November 8, 2026

Last Modified

November 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-123544 →

📋 Description

OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal server-to-server SOAP channel, allowing network-positioned attackers to affect integrity and availability. Attackers who intercept unencrypted traffic or control a site server can crash receiving processes, tamper with writable files, and possibly execute code.

🔗 References (4)

https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-6gg2-2v5m-454x
https://nvd.nist.gov/vuln/detail/CVE-2026-123544
https://www.vulncheck.com/advisories/openam-before-16.1.4-insufficient-response-validation-in-internal-soap-channel
https://github.com/advisories/GHSA-xv75-9hr2-vf5x