CVE-2026-123551 PUBLISHED

OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocket

Assigner: VulnCheck
Reserved: 06.11.2026 Published: 08.11.2026 Updated: 08.11.2026

OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to read live session tokens from the notification WebSocket. Attackers can bypass the agent-only check through an unvalidated internal forward on legacy Liberty ID-FF endpoints, collecting iPlanetDirectoryPro tokens to hijack user and administrator sessions.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS Score: 10

Product Status

Vendor OpenIdentityPlatform
Product OpenAM
Versions Default: unaffected
  • affected from 14.0.0 to 16.1.4 (excl.)
  • Version 16.1.4 is unaffected
Vendor OpenIdentityPlatform
Product OpenAM
Versions Default: unaffected
  • affected from 14.0.0 to 16.1.4 (excl.)
  • Version 16.1.4 is unaffected
Vendor OpenIdentityPlatform
Product OpenAM
Versions Default: unaffected
  • affected from 14.0.0 to 16.1.4 (excl.)
  • Version 16.1.4 is unaffected

Credits

  • DauHoangTai reporter
  • maximthomas remediation developer
  • tsujiguchitky remediation reviewer
  • vharseko remediation reviewer

References

Problem Types

  • Insertion of Sensitive Information Into Sent Data CWE