CVE-2026-123551: Session Token Disclosure in OpenAM

CVE-2026-123551 is an information disclosure vulnerability in OpenAM that allows unauthenticated attackers to read live session tokens from the notification WebSocket. The flaw affects versions 14.0.0 up to (but not including) 16.1.4 and can be exploited by bypassing the agent-only check through an unvalidated internal forward on legacy Liberty ID-FF endpoints. Captured iPlanetDirectoryPro tokens can be used to hijack sessions of regular users and administrators.

The CVSS score is 10.0, the maximum level, and the vulnerability is classified as critical. The official NVD description confirms the information disclosure and the risk of session hijacking. The vulnerability was published on NVD on 2026-11-08. Social media activity in the past 24 hours mentions this and other critical issues in OpenAM.

Administrators and security teams must immediately update OpenAM to version 16.1.4 or later. It is critical to verify whether OpenAM is deployed in production environments and whether it exposes Liberty ID-FF endpoints. During the update phase, monitor authentication logs and WebSocket requests for suspicious activity. Revoking active session tokens if possible is an additional mitigation measure.