OpenAM Vulnerability in SAML IdP Functionality Due to Request Tampering

A vulnerability in OpenAM (OpenAM Consortium Edition) versions 14.0.0 prior to 14.0.1 may disrupt its operation as a SAML Identity Provider (IdP) by allowing request tampering. This manipulation can interfere with OpenAM's internal caching, leading to improper SAML IdP functionality.

Impact

Request tampering can alter OpenAM's internal cache, causing disruptions in SAML IdP operations.

Remediation

Users are advised to update to OpenAM version 14.0.2, which addresses this vulnerability. For those using the 'Trust Circle' settings under 'Integration', only one trust circle should be configured as a temporary measure.