Act nowDisclosed

Advisory · CVE-2026-123551

OpenAM leaks live session tokens through its notification WebSocket

OpenAM 14.0.0 before 16.1.4 lets unauthenticated attackers read live session tokens from the notification WebSocket by bypassing the agent-only check through an unvalidated internal forward on legacy Liberty ID-FF endpoints, rated critical at CVSS 10.0; fixed in 16.1.4.

Advisory published November 8, 2026Independent summary
Vendor
OpenIdentityPlatform
Product
OpenAM
Identifier / CWE
CVE-2026-123551
CWE-201
Action timing
Immediate
ELI5

Explain it like I’m five

OpenAM hands out session tokens like wristbands that prove who you are. A flaw in its live-notification channel lets a stranger peek at other people's wristbands and then wear one to walk in as them, including admins.

SIMPLIFIED_ATTACK_PATH05 STEPS
  1. 01Attacker reaches the WebSocket

    An unauthenticated attacker connects to the notification WebSocket.

  2. 02Agent check bypassed

    An unvalidated internal forward on legacy Liberty ID-FF endpoints skips the agent-only restriction.

  3. 03Tokens collected

    Live iPlanetDirectoryPro session tokens are read from the channel.

  4. 04Session hijacked

    The attacker replays a token as the victim user.

  5. 05Admin access

    Administrator sessions are among those exposed, giving full control.

What happened

OpenAM from 14.0.0 before 16.1.4 contains an information disclosure flaw that allows unauthenticated attackers to read live session tokens from the notification WebSocket. Attackers can bypass the agent-only check through an unvalidated internal forward on legacy Liberty ID-FF endpoints, collecting iPlanetDirectoryPro tokens to hijack user and administrator sessions. The record rates it critical at CVSS 10.0 under versions 3.1 and 4.0, with network attack vector, low complexity, no privileges required, and no user interaction.

A leaked session token is a live login, not a password guess. Any token collected before the fix stays usable until it expires or is revoked, so patching alone does not close the exposure. The flaw is fixed in OpenAM 16.1.4.

What to do

  1. Inventory OpenAM deployments and record each version.
  2. Upgrade to OpenAM 16.1.4 or later.
  3. Invalidate active sessions and force re-authentication for administrative accounts.
  4. Review WebSocket and session logs for unauthenticated access to the notification channel.
  5. Treat any session that cannot be accounted for as a compromise indicator and rotate the affected credentials.
  6. Verify the deployed version after updating.

Management note

A maximum-severity session leak in the identity layer means the incident window is every session alive before the patch. Invalidate sessions, then patch, in that order of urgency.