CVE-2026-105121

MEDIUMCVSS 4.9

Description

OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their realms because realm checks use the requester's realm. Authenticated accounts holding the iplanet-am-session-destroy-sessions attribute can supply a target session identifier or handle to forcibly log out users in any realm.

Timeline

Published:October 3rd, 2026 2:16 PM

Last modified:October 5th, 2026 9:16 PM

CVSS Scoring

CVSS v3: 4.9 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-285

References & Reports

Advisories, patches, and third-party reports

https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-hmwh-9r8r-44gw
https://www.vulncheck.com/advisories/openam-before-16.1.3-improper-authorization-in-delegated-session-destroy-realm-scoping

Source: NIST NVD · Data may lag official sources by up to one minute