CVE-2021-4201: Pre-authentication session hijacking

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-02-14 · updated 2026-06-17
Weakness: CWE-284

Description

Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthenticated attackers to hijack sessions, including potentially admin-level sessions. This issue affects: ForgeRock Access Management 7.1 versions prior to 7.1.1; 6.5 versions prior to 6.5.4; all previous versions.

Affected products

ForgeRock Access Management: 5.5.2, 6.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, 6.0.0.4 (+14)

References

https://backstage.forgerock.com/knowledge/kb/article/a50037155#x7ZPA0
https://backstage.forgerock.com/knowledge/kb/article/a50037155#x7ZPA0

Get alerted when CVE-2021-4201 or the next vulnerability affects your stack