A critical flaw (CVSS 10.0) in OpenAM 14.0.0 through 16.1.3 lets unauthenticated attackers read live session tokens and hijack user and administrator sessions.
What Is It
CVE-2026-123551 is an information disclosure vulnerability (CWE-201) in OpenIdentityPlatform's OpenAM. Per the NVD description, unauthenticated attackers can read live session tokens from OpenAM's notification WebSocket. The WebSocket is supposed to be protected by an agent-only check. Attackers get around that check through an unvalidated internal forward on legacy Liberty ID-FF endpoints. From there they can collect iPlanetDirectoryPro tokens, which are OpenAM session cookies, and use them to take over active user and administrator sessions.
VulnCheck reported the issue, and NVD has published it. NVD lists its status as "Received," so NVD has not finished its own analysis.
Why It Matters
OpenAM is an access management platform, so a stolen session token means access to whatever that session can reach. If an administrator's token is captured, the attacker may gain control of the identity provider itself.
The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) describes an attack that:
- works over the network
- is low complexity
- needs no privileges or user interaction
- has a changed scope, with high impact to confidentiality, integrity and availability
The CVSS v4.0 score is also 10.0 CRITICAL, with high impact rated for the vulnerable system and for subsequent systems. That fits a compromise that spreads to the applications relying on OpenAM.
What's Vulnerable
These OpenIdentityPlatform OpenAM Maven packages are affected from version 14.0.0 up to, but not including, 16.1.4:
org.openidentityplatform.openam/openam-server-onlyorg.openidentityplatform.openam/openam-federation-libraryorg.openidentityplatform.openam/openam-notifications-websocket
The attack path relies on the legacy Liberty ID-FF endpoints and the notification WebSocket component.
Patch Status
Version 16.1.4 is listed as unaffected for all three packages. Organizations running OpenAM 14.0.0 through 16.1.3 should upgrade to 16.1.4 or later. Because the flaw exposes live session tokens, also consider whether sessions active on exposed instances, especially administrator sessions, could have been captured. See the vendor's GitHub security advisory for full remediation guidance.