Multiple Critical Vulnerabilities Found in Identity Management Platform OpenAM

Multiple vulnerabilities have been revealed in the identity management platform OpenAM. Some of these have been rated as 'Critical', and all have been addressed in an update released in October.

Open Identity Platform disclosed 18 vulnerabilities at 18:00 local time on October 22, 2026, and published the updated version OpenAM 16.1.4. Subsequently, they were assigned CVE numbers.

Among these, three vulnerabilities have been rated as 'Critical' on a four-tier scale. CVE-2026-123551 is a vulnerability that allows session tokens of users to be leaked by bypassing authentication checks when connecting to WebSocket, which notifies the start and end of sessions.

This vulnerability could enable the takeover of sessions of users, including administrators. VulnCheck, which assigned the CVE number, has evaluated the base score according to the Common Vulnerability Scoring System CVSS v4.0 at the maximum value of '10.0'.