# CVE-2026-123551

Unauthenticated WebSocket token leak in OpenAM enabling session hijack.

- Page: https://www.vulneraibility.com/cve/CVE-2026-123551
- CVSS: 10.0
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-201
- Published: 2026-11-08

## Affected versions

- OpenIdentityPlatform OpenAM: affected >= 14.0.0 and < 16.1.4; fixed in 16.1.4

A version outside these ranges is not a statement that it is unaffected.

## Impact

Attackers can read live session tokens via notification WebSocket and hijack user and admin sessions (iPlanetDirectoryPro).

## Action

Immediate action required

## Recommendation

Upgrade to 16.1.4+, disable legacy ID-FF endpoints, restrict WebSocket access

## References

- [advisory] https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-5c3q-hp86-xjr8
- [advisory] https://www.vulncheck.com/advisories/openam-14.0.0-before-16.1.4-session-token-disclosure-via-notification-websocket

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.