OpenAM: Unauthenticated information disclosure via Liberty ID-FF (CVE-2026-123551)
OpenAM versions 14.0.0 through 16.1.3 contain an information disclosure vulnerability that allows unauthenticated attackers to hijack sessions by capturing iPlanetDirectoryPro tokens via WebSocket endpoints.
CVE search metadata
CVE search record: CVE-2026-123551. Severity: critical. CVSS: 10.0. KEV: no. Product: OpenAM (14.0.0 - 16.1.3). Brief: OpenAM: Unauthenticated information disclosure via Liberty ID-FF (CVE-2026-123551). Brief link: https://feed.craftedsignal.io/briefs/2026-11-openam-info-disclosure/
Triage facts
Revision 2- Applicability
- OpenAM (14.0.0 - 16.1.3)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 2 public sources
- Freshness
- Revision 2Nov 8, 07:19 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Very likely
Revision history 1 entry · Revision 2
- Revision 2
poc_available
Changed: claim_state, has_poc, lastmod, poc_references, references, updates
Sources: 1
OpenAM contains an information disclosure vulnerability (CVE-2026-123551) affecting versions 14.0.0 through 16.1.3. An unvalidated internal forward on legacy Liberty ID-FF endpoints allows unauthenticated attackers to bypass agent-only restrictions. Successful exploitation permits the retrieval of live iPlanetDirectoryPro session tokens through the notification WebSocket, enabling session hijacking of both standard users and administrators.
Impact
Successful exploitation allows unauthenticated attackers to steal active session tokens. This leads to complete session hijacking, providing unauthorized access to the privileges and data associated with the compromised user or administrator account.
Recommendation
- Upgrade OpenAM to version 16.1.4 or later to remediate the vulnerability.
- Implement access control lists at the web application firewall or load balancer layer to restrict access to legacy Liberty ID-FF endpoints.
- Audit WebSocket notification traffic for unauthorized or anomalous subscription requests.
Immediate actions
Patch OpenAM to version 16.1.4 or later
Threat Hunt
Identify unauthenticated requests to legacy Liberty ID-FF endpoints
Data: Web server access logs
Mitigations
Disable or restrict access to legacy Liberty ID-FF endpoints
CVE-2026-123551