CVE-2026-105121

4.9 MEDIUMpublic exploit available

Published 2026-10-03 · Updated 2026-10-06

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their realms because realm checks use the requester's realm. Authenticated accounts holding the iplanet-am-session-destroy-sessions attribute can supply a target session identifier or handle to forcibly log out users in any realm.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-285

Public exploit & PoC references

https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-hmwh-9r8r-44gw

All references

https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-hmwh-9r8r-44gw
https://www.vulncheck.com/advisories/openam-before-16.1.3-improper-authorization-in-delegated-session-destroy-realm-scoping

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2023-54410PoC
HIGHCVE-2025-71426PoC
HIGHCVE-2026-10030
MEDIUMCVE-2026-100878PoC
HIGHCVE-2026-100885PoC
MEDIUMCVE-2026-100897
MEDIUMCVE-2026-101006
MEDIUMCVE-2026-102261PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.