CVE-2026-123551Critical· 10.0▾ MidnightOpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to read live session tokens from the notification WebSocket. Attackers can bypass the agent-only check through an unv…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 55 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to read live session tokens from the notification WebSocket. Attackers can bypass the agent-only check through an unvalidated internal forward on legacy Liberty ID-FF endpoints, collecting iPlanetDirectoryPro tokens to hijack user and administrator sessions.
OpenAM >= 14.0.0 < 16.1.4OpenAM >= 14.0.0 < 16.1.4OpenAM >= 14.0.0 < 16.1.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-45049High· 8.3OpenAM Session Hijacking via CDSSO
CVE-2026-123537Medium· 5.0OpenAM before 16.1.4 SSRF via UMA Scope Description URLs
CVE-2026-123536Medium· 4.1OpenAM before 16.1.4 SSRF via Federation Configuration Wizard Metadata URLs
CVE-2026-123538Medium· 6.6OpenAM before 16.1.4 SAML 1.x Signature Verification Issuer Impersonation
CVE-2026-123539Medium· 4.8OpenAM before 16.1.4 Stored XSS via OAuth 2.0 Consent Page Display Name
CVE-2026-123541Medium· 4.7OpenAM before 16.1.4 Open Redirect via SAML 1.x Trusted-Partner Matching