CVE-2026-123553

6.5 MEDIUMpublic exploit available

Published 2026-11-08 · Updated 2026-11-10

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

OpenAM before 16.1.4 ships built-in identities in the Top Level Realm (demo, anonymous, wsc, wsp, SecurityTokenService and agentAuth) with passwords that are identical on every installation, publicly known, and able to authenticate. Unauthenticated remote attackers can log in as these identities to obtain authenticated sessions, and the agent identities can read the configuration of other agent profiles.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weaknesses

CWE-1392

Public exploit & PoC references

https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-hvfc-4v4r-8p9w

All references

https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-hvfc-4v4r-8p9w
https://www.vulncheck.com/advisories/openam-before-16.1.4-default-credentials-in-built-in-accounts-allow-unauthenticated-login

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

UNSCOREDCVE-2026-100103
CRITICALCVE-2026-108263PoC
HIGHCVE-2026-108783PoC
UNSCOREDCVE-2026-111257
CRITICALCVE-2026-111329PoC
CRITICALCVE-2026-111693PoC
CRITICALCVE-2026-111998PoC
CRITICALCVE-2026-112296PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.