CVE-2026-123551

Summary

OpenAM versions before 16.1.4 expose live session tokens via an unauthenticated WebSocket endpoint due to an internal forward bypass on legacy Liberty ID-FF endpoints, allowing attackers to collect iPlanetDirectoryPro tokens and hijack active sessions without authentication.

Exploitability

Exploitation is trivial for unauthenticated remote attackers as it requires no prior access, user interaction, or special conditions beyond network reachability to the vulnerable WebSocket endpoint.

Blast radius

Successful exploitation enables full session hijacking of both users and administrators, leading to complete compromise of confidentiality, integrity, and availability across the OpenAM deployment.

Detection

Defenders should monitor for repeated unauthenticated WebSocket connection attempts to /openidm/websocket or similar notification endpoints, especially with missing or invalid session tokens in the iPlanetDirectoryPro cookie header, and correlate with anomalous token reuse across unrelated sessions in audit logs.

Prioritized remediation

Upgrade to OpenAM 16.1.4 or later immediately; if upgrading is not feasible, disable legacy Liberty ID-FF endpoints and restrict WebSocket access to authenticated agents only.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.