Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-123551: OpenAM may expose session tokens through notification WebSocket
CVE-2026-123551 · published today
Summary
Versions of OpenAM from 14.0.0 up to 16.1.3 let anyone connect to a special notification channel and read active session tokens. This can let an attacker take over user or administrator accounts. Upgrade OpenAM to version 16.1.4 or later, or apply the vendor's recommended patch, to stop the leakage.
What to do
- Update openidentityplatform openam to version 16.1.4 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| openidentityplatform | openam | < 16.1.4 |
Original advisory text
OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocket
OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to read live session tokens from the notification WebSocket. Attackers can bypass the agent-only check through an unvalidated internal forward on legacy Liberty ID-FF endpoints, collecting iPlanetDirectoryPro tokens to hijack user and administrator sessions.
References
- https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-5c3q-hp8... Vendor Advisory
- https://www.vulncheck.com/advisories/openam-14.0.0-before-16.1.4-session-token-d... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-1235... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-123551 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Severity
9.9
Critical
Type
CWE-201Insertion of Sensitive Information Into Sent Data
Timeline
Published8 Nov 2026
Updated8 Nov 2026
First seen8 Nov 2026
Sources
CVE-2026-123551 · NVD
CVE-2026-123551 · MITRE
CVE-2026-123551 · OSV
GHSA-5c3q-hp86-xjr8 · GHSA
Track software like this
Free during beta