{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aopenamopenam/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:openam:openam:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":10,"id":"CVE-2026-123551"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=CVE-2026-123551\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["OpenAM (14.0.0 - 16.1.3)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["OpenAM"],"content_html":"\u003cp\u003eOpenAM contains an information disclosure vulnerability (CVE-2026-123551) affecting versions 14.0.0 through 16.1.3. An unvalidated internal forward on legacy Liberty ID-FF endpoints allows unauthenticated attackers to bypass agent-only restrictions. Successful exploitation permits the retrieval of live iPlanetDirectoryPro session tokens through the notification WebSocket, enabling session hijacking of both standard users and administrators.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to steal active session tokens. This leads to complete session hijacking, providing unauthorized access to the privileges and data associated with the compromised user or administrator account.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenAM to version 16.1.4 or later to remediate the vulnerability.\u003c/li\u003e\n\u003cli\u003eImplement access control lists at the web application firewall or load balancer layer to restrict access to legacy Liberty ID-FF endpoints.\u003c/li\u003e\n\u003cli\u003eAudit WebSocket notification traffic for unauthorized or anomalous subscription requests.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T07:18:26Z","date_published":"2026-11-08T06:55:29Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openam-info-disclosure/","summary":"OpenAM versions 14.0.0 through 16.1.3 contain an information disclosure vulnerability that allows unauthenticated attackers to hijack sessions by capturing iPlanetDirectoryPro tokens via WebSocket endpoints.","title":"OpenAM: Unauthenticated information disclosure via Liberty ID-FF (CVE-2026-123551)","url":"https://feed.craftedsignal.io/briefs/2026-11-openam-info-disclosure/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:openam:openam:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}