CVE-2026-123551 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-123551 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-123551 is a critical information disclosure flaw in OpenAM affecting versions 14.0.0 through 16.1.3. A remote, unauthenticated attacker can abuse the notification WebSocket and a legacy Liberty ID-FF internal forward to read live session tokens, including iPlanetDirectoryPro. That can let an attacker hijack user and administrator sessions without needing credentials.

This is a CVSS 10 issue. Even though it is not currently listed in KEV and there are no confirmed wild exploits, the impact is severe enough that solo developers and small teams should treat it as an emergency patch-and-verify event.

Immediate Action

  • Upgrade immediately to OpenAM 16.1.4 or later. If you cannot patch today, isolate the service from untrusted networks and restrict access to the notification WebSocket.
  • Disable or block legacy Liberty ID-FF endpoints if your deployment does not require them. The bypass depends on an internal forward path tied to these legacy endpoints.
  • Rotate all session-related secrets and invalidate active sessions after patching, especially if you suspect exposure of iPlanetDirectoryPro tokens.
  • Review reverse proxy and WAF rules to deny direct access to WebSocket and legacy auth paths until the fix is confirmed.
  • Check vendor guidance and release notes: vendor advisory / release notes.

Affected Versions

  • OpenAM 14.0.0 through 16.1.3 vulnerable
  • OpenAM 16.1.4 and later safe
  • If you run a repackaged or containerized build, treat any image or bundle containing 14.0.0-16.1.3 as vulnerable until proven otherwise

Resolution Guide

Best fix: upgrade to the patched release and force session invalidation.

# Example: container/image update
docker pull TODO_VENDOR/openam:16.1.4
docker stop openam
docker rm openam
docker run -d --name openam TODO_VENDOR/openam:16.1.4
# If installed from a package repository (placeholder)
sudo apt-get update
sudo apt-get install --only-upgrade openam=16.1.4-1

sudo yum update openam-16.1.4

Java dependency workflows: if OpenAM is embedded as a library or platform component, update the artifact to the fixed version.

// Maven
<dependency>
  <groupId>TODO.groupId</groupId>
  <artifactId>openam</artifactId>
  <version>16.1.4</version>
</dependency>
// Gradle
dependencies {
  implementation "TODO.groupId:openam:16.1.4"
}

JavaScript/Python tooling is usually not the delivery path for OpenAM itself, but if your app wraps it through a client or admin SDK, update those dependencies too:

# npm / yarn / pnpm examples
npm i TODO-openam-client@latest
yarn add TODO-openam-client@latest
pnpm add TODO-openam-client@latest

# pip / pipx examples
pip install -U TODO-openam-client
pipx upgrade TODO-openam-client

Hardening while you patch:

# Example reverse-proxy hardening: block legacy endpoints and WebSocket access
location ~* ^/(.*liberty.*|.*idff.*|.*notification.*websocket.*) {
  deny all;
  return 403;
}
# If your deployment supports feature flags or config toggles, disable legacy federation paths
# TODO: set legacy_liberty_idff=false
# TODO: set notification_websocket=false
# TODO: restrict internal_forwarding=true only for trusted internal callers

Minimal code-level guard example if you maintain a wrapper or fork that routes requests internally:

// Pseudocode: reject untrusted internal forwards
if (isLegacyLibertyEndpoint(request) && !isTrustedInternalCaller(request)) {
    response.sendError(403);
    return;
}

Detection & Verification

Check your version first. Look for the installed package, container tag, or deployed artifact version:

openam --version
docker inspect --format '{{.Config.Image}}' openam
grep -R "16\.1\.[0-3]\|14\.0\.0" /opt/openam /etc/openam 2>/dev/null

Search for risky paths and legacy features:

grep -R "liberty\|id-ff\|notification.*websocket\|iPlanetDirectoryPro" /opt/openam /etc/openam 2>/dev/null

Dependency and image audits:

# Java dependency tree
mvn dependency:tree | grep -i openam
gradle dependencies | grep -i openam

# Container scan
trivy image TODO_VENDOR/openam:16.1.3
grype TODO_VENDOR/openam:16.1.3

Verify the fix: confirm the deployed version is 16.1.4 or later, then test that legacy endpoints are blocked and the notification WebSocket no longer exposes session tokens. Re-run your proxy rules and scan results after restart.

# Confirm no vulnerable version remains
docker ps --format '{{.Image}}' | grep -E '16\.1\.[0-3]|14\.0\.0' && echo "VULNERABLE" || echo "OK"

# Confirm blocked endpoints return 403/404
curl -i https://your-openam.example.com/TODO_LEGACY_ENDPOINT
curl -i https://your-openam.example.com/TODO_WEBSOCKET_PATH

Risk and Impact

An attacker who reaches this flaw can read active session tokens and impersonate users, including administrators. That can lead to account takeover, privilege escalation, data access, and changes to authentication or federation settings. For a small team, the blast radius can include the entire identity layer: apps, admin consoles, and any service that trusts OpenAM sessions.

Bottom line: patch to 16.1.4+ now, block legacy federation paths, and invalidate sessions after remediation.

Keep reading