What’s Vulnerable › Vulnerabilities

CVE-2026-105121: OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping

• Severity: medium (CVSS 4.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-03 · updated 2026-10-06
• Weakness: CWE-285

Description

OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their realms because realm checks use the requester's realm. Authenticated accounts holding the iplanet-am-session-destroy-sessions attribute can supply a target session identifier or handle to forcibly log out users in any realm.

Affected products

• OpenIdentityPlatform OpenAM: before 16.1.3 — fixed in 16.1.3

How to fix

Upgrade to a fixed version: OpenIdentityPlatform OpenAM 16.1.3. Check the vendor advisory for mitigations.

References

• https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-hmwh-9r8r-44gw
• https://www.vulncheck.com/advisories/openam-before-16.1.3-improper-authorization-in-delegated-session-destroy-realm-scoping

Get alerted when CVE-2026-105121 or the next vulnerability affects your stack