Detections
Analytics

OpenAM Unauthenticated Session Token Disclosure

critical Web App Scanning Plugin ID 115817

Synopsis

OpenAM Unauthenticated Session Token Disclosure

Description

Open Identity Platform OpenAM versions from 14.0.0 before 16.1.4 are affected by an authentication bypass in the agent notification WebSocket service. When agent notifications are enabled, OpenAM broadcasts the full iPlanetDirectoryPro session token for every session creation, logout, timeout, and property change on the /agent/session topic, which is intended to be reachable by authenticated policy agents only. An unauthenticated attacker can reach this agent-only notification WebSocket through an unvalidated internal forward exposed by the legacy Liberty ID-FF postLogin endpoint and subscribe to that topic, collecting live bearer session tokens. A collected token can be used to impersonate the associated user, including administrators, and may lead to full configuration takeover.

Solution

Upgrade OpenAM to version 16.1.4 or later, which applies the security filters to internal dispatches and limits WebSocket subscriptions to /agent/ topics. As a workaround, block access to the /notifications and /ws endpoints and to the legacy ID-FF postLogin endpoint, and/or disable agent notifications by setting org.forgerock.openam.notifications.agents.enabled to false.

See Also

https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-5c3q-hp86-xjr8

Plugin Details

Severity: Critical

ID: 115817

Type: Check Based

Published: 11/9/2026

Updated: 11/9/2026

Scan Template: basic, full, pci, scan

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 92.81

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-123551

CVSS v3

Risk Factor: Critical

Base Score: 10

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVSS Score Source: CVE-2026-123551

CVSS v4

Risk Factor: Critical

Base Score: 10

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVSS Score Source: CVE-2026-123551

Vulnerability Information

CPE: cpe:2.3:a:openidentityplatform:openam:*:*:*:*:*:*:*:*

Vulnerability Publication Date: 11/7/2026

Reference Information

CVE: CVE-2026-123551

CWE: 201, 288, 522, 601, 862

OWASP: 2010-A10, 2010-A3, 2010-A4, 2010-A6, 2010-A8, 2013-A10, 2013-A2, 2013-A4, 2013-A5, 2013-A7, 2013-A9, 2017-A2, 2017-A5, 2017-A6, 2017-A9, 2021-A1, 2021-A4, 2021-A6, 2021-A7, 2025-A1, 2025-A6, 2025-A7

WASC: Information Leakage, Insufficient Authentication, Insufficient Authorization, URL Redirector Abuse

CAPEC: 102, 114, 115, 116, 13, 151, 169, 194, 22, 224, 285, 287, 290, 291, 292, 293, 294, 295, 296, 297, 298, 299, 300, 301, 302, 303, 304, 305, 306, 307, 308, 309, 310, 312, 313, 317, 318, 319, 320, 321, 322, 323, 324, 325, 326, 327, 328, 329, 330, 472, 474, 497, 50, 508, 509, 551, 555, 560, 561, 57, 573, 574, 575, 576, 577, 59, 593, 60, 600, 616, 633, 643, 644, 645, 646, 650, 651, 652, 653, 79, 94

DISA STIG: APSC-DV-000460, APSC-DV-002560, APSC-DV-002630

HIPAA: 164.306(a)(1), 164.306(a)(2), 164.312(a)(1), 164.312(a)(2)(i)

ISO: 27001-A.13.1.1, 27001-A.14.1.2, 27001-A.14.1.3, 27001-A.14.2.5, 27001-A.18.1.3, 27001-A.6.2.2, 27001-A.9.1.2, 27001-A.9.2.1, 27001-A.9.2.4, 27001-A.9.3.1, 27001-A.9.4.1, 27001-A.9.4.3, 27001-A.9.4.4, 27001-A.9.4.5

NIST: sp800_53-AC-3, sp800_53-CM-6b, sp800_53-IA-5, sp800_53-SI-10, sp800_53-SI-15

OWASP API: 2019-API7, 2023-API8

OWASP ASVS: 4.0.2-14.2.1, 4.0.2-5.1.5, 4.0.2-8.3.4

PCI-DSS: 3.2-6.2, 3.2-6.5.10, 3.2-6.5.8