{"id":"CVE-2026-123551","published":"2026-11-08T02:16:46.603","lastModified":"2026-11-10T22:13:29.767","description":"OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to read live session tokens from the notification WebSocket. Attackers can bypass the agent-only check through an unvalidated internal forward on legacy Liberty ID-FF endpoints, collecting iPlanetDirectoryPro tokens to hijack user and administrator sessions.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-201"],"vendors":[],"products":[],"references":[{"url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-5c3q-hp86-xjr8","tags":[]},{"url":"https://www.vulncheck.com/advisories/openam-14.0.0-before-16.1.4-session-token-disclosure-via-notification-websocket","tags":[]}],"exploitRefs":[{"url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-5c3q-hp86-xjr8","tags":[]}],"hasPoc":true,"ai":{"summary":"OpenAM versions before 16.1.4 expose live session tokens via an unauthenticated WebSocket endpoint due to an internal forward bypass on legacy Liberty ID-FF endpoints, allowing attackers to collect iPlanetDirectoryPro tokens and hijack active sessions without authentication.","exploitability":"Exploitation is trivial for unauthenticated remote attackers as it requires no prior access, user interaction, or special conditions beyond network reachability to the vulnerable WebSocket endpoint.","blast_radius":"Successful exploitation enables full session hijacking of both users and administrators, leading to complete compromise of confidentiality, integrity, and availability across the OpenAM deployment.","remediation":"Upgrade to OpenAM 16.1.4 or later immediately; if upgrading is not feasible, disable legacy Liberty ID-FF endpoints and restrict WebSocket access to authenticated agents only.","detection":"Defenders should monitor for repeated unauthenticated WebSocket connection attempts to /openidm/websocket or similar notification endpoints, especially with missing or invalid session tokens in the iPlanetDirectoryPro cookie header, and correlate with anomalous token reuse across unrelated sessions in audit logs.","tags":["information-disclosure","session-hijack","auth-bypass","websocket","legacy-endpoint"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:45:06.672Z"}}