CriticalCritical vulnerability

CVE-2026-123551 (CVSS 10.0)

NVD · officialPublished Nov 8, 2026Risk 50/100EPSS 0.4%

OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to read live session tokens from the notification WebSocket. Attackers can bypass the agent-only check through an unvalidated internal forward on legacy Liberty ID-FF endpoints, collecting iPlanetDirectoryPro tokens to hijack user and administrator sessions.

Technical details

CVSS

10.0

AV:NetworkAC:LowPR:NoneUI:None

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source