OpenAM (14.0.0 - 16.1.3) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/openam-14.0.0---16.1.3/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 08 Nov 2026 06:55:29 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOpenAM: Unauthenticated information disclosure via Liberty ID-FF (CVE-2026-123551)https://feed.craftedsignal.io/briefs/2026-11-openam-info-disclosure/Sun, 08 Nov 2026 06:55:29 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-openam-info-disclosure/OpenAM versions 14.0.0 through 16.1.3 contain an information disclosure vulnerability that allows unauthenticated attackers to hijack sessions by capturing iPlanetDirectoryPro tokens via WebSocket endpoints.OpenAM contains an information disclosure vulnerability (CVE-2026-123551) affecting versions 14.0.0 through 16.1.3. An unvalidated internal forward on legacy Liberty ID-FF endpoints allows unauthenticated attackers to bypass agent-only restrictions. Successful exploitation permits the retrieval of live iPlanetDirectoryPro session tokens through the notification WebSocket, enabling session hijacking of both standard users and administrators.

Impact

Successful exploitation allows unauthenticated attackers to steal active session tokens. This leads to complete session hijacking, providing unauthorized access to the privileges and data associated with the compromised user or administrator account.

Recommendation

  • Upgrade OpenAM to version 16.1.4 or later to remediate the vulnerability.
  • Implement access control lists at the web application firewall or load balancer layer to restrict access to legacy Liberty ID-FF endpoints.
  • Audit WebSocket notification traffic for unauthorized or anomalous subscription requests.
]]>criticaladvisory