CVE-2026-123553 PUBLISHED

OpenAM before 16.1.4 Default Credentials in Built-in Accounts Allow Unauthenticated Login

Assigner: VulnCheck
Reserved: 06.11.2026 Published: 08.11.2026 Updated: 08.11.2026

OpenAM before 16.1.4 ships built-in identities in the Top Level Realm (demo, anonymous, wsc, wsp, SecurityTokenService and agentAuth) with passwords that are identical on every installation, publicly known, and able to authenticate. Unauthenticated remote attackers can log in as these identities to obtain authenticated sessions, and the agent identities can read the configuration of other agent profiles.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS Score: 6.9

Product Status

Vendor OpenIdentityPlatform
Product OpenAM
Versions Default: unaffected
  • affected from 0 to 16.1.4 (excl.)
  • Version 16.1.4 is unaffected
Vendor OpenIdentityPlatform
Product OpenAM
Versions Default: unaffected
  • affected from 0 to 16.1.4 (excl.)
  • Version 16.1.4 is unaffected
Vendor OpenIdentityPlatform
Product OpenAM
Versions Default: unaffected
  • affected from 0 to 16.1.4 (excl.)
  • Version 16.1.4 is unaffected

Credits

  • FireBurn reporter
  • maximthomas remediation reviewer
  • tsujiguchitky remediation reviewer
  • vharseko remediation developer

References

Problem Types

  • Use of Default Credentials CWE