OpenAM (14.0.0 - 16.1.3)

OpenAM versions 14.0.0 through 16.1.3 contain an information disclosure vulnerability that allows unauthenticated attackers to hijack sessions by capturing iPlanetDirectoryPro tokens via WebSocket endpoints.