CVE-2026-123551 OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocket

CriticalCVSS 10.0

Published: 2026-11-08 03:37
Updated: 2026-11-08 03:37
Exploit status: No public exploit known

Description

OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to read live session tokens from the notification WebSocket. Attackers can bypass the agent-only check through an unvalidated internal forward on legacy Liberty ID-FF endpoints, collecting iPlanetDirectoryPro tokens to hijack user and administrator sessions.

Affected products

Product	Affected versions	Fixed in
org.openidentityplatform.openam/openam-server-only	>= 14.0.0, < 16.1.4	16.1.4
org.openidentityplatform.openam/openam-federation-library	>= 14.0.0, < 16.1.4	16.1.4
org.openidentityplatform.openam/openam-notifications-websocket	>= 14.0.0, < 16.1.4	16.1.4

References

GitHub Security Advisory (GHSA-5c3q-hp86-xjr8) vendor-advisory
VulnCheck Advisory: OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocket third-party-advisory

CVSS v4.0

10.0 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: High
Subsequent System Confidentiality: High
Subsequent System Integrity: High
Subsequent System Availability: High

All scores (2)

v4.0 10.0 · vulncheck
v3.1 10.0 · vulncheck

Weakness & likelihood

EPSS (exploitation probability, 30 days): Not available
CWE: CWE-201 Insertion of Sensitive Information Into Sent Data

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.