CVE-2026-123551

CRITICAL 10.0

OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocket

CVSS Score

10.0

EPSS Score

0.0%

EPSS Percentile

0th

OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to read live session tokens from the notification WebSocket. Attackers can bypass the agent-only check through an unvalidated internal forward on legacy Liberty ID-FF endpoints, collecting iPlanetDirectoryPro tokens to hijack user and administrator sessions.

CWE	CWE-201
Vendor	openidentityplatform
Product	openam
Published	Nov 8, 2026

Stay Ahead of the Next One

Get instant alerts for openidentityplatform openam

Be the first to know when new critical vulnerabilities affecting openidentityplatform openam are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

OpenIdentityPlatform / OpenAM

14.0.0 < 16.1.4

OpenIdentityPlatform / OpenAM

14.0.0 < 16.1.4

OpenIdentityPlatform / OpenAM

14.0.0 < 16.1.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-5c3q-hp86-xjr8 vulncheck.com: https://www.vulncheck.com/advisories/openam-14.0.0-before-16.1.4-session-token-disclosure-via-notification-websocket

Credits

🔍 DauHoangTai maximthomas tsujiguchitky vharseko