A critical flaw in the OpenAM identity platform lets an unauthenticated attacker read live session tokens of other users, including administrators. Tracked as CVE-2026-123551, it carries the maximum CVSS score of 10.0 and was published on 8 November 2026. It affects OpenAM 14.0.0 through 16.1.3 and is fixed in 16.1.4.

The flaw sits in OpenAM's notification WebSocket. With agent notifications on, as they are by default, OpenAM broadcasts the full session identifier of every session created, changed or ended to the topic policy agents subscribe to. Only policy agents should connect to that WebSocket, but the vendor advisory says the check can be bypassed without credentials through an unvalidated internal request forward on legacy Liberty ID-FF endpoints.

An attacker who can reach the OpenAM port and hold a WebSocket connection can therefore quietly collect the live token of every user active while the connection is open. A session token works directly as a bearer credential against OpenAM's REST endpoints and against every application that relies on OpenAM for single sign-on, so a stolen token lets the attacker act as that user. Capturing an administrator's session is the worst case: it hands over a super-user session that can be escalated to configuration takeover and command execution on the server.

Collection is passive, producing no failed logins or lockouts, and hijacked requests look identical to the legitimate user's own activity. No exploitation has been reported, and proof-of-concept code is being withheld to give operators time to upgrade.

Until 16.1.4 is deployed, the advisory recommends restricting the notification endpoints to agent hosts only, disabling agent notifications where agents do not depend on them, and blocking the legacy ID-FF endpoints unless federation is in use. The same release also fixes CVE-2026-123550, a SAML authentication bypass rated 9.8, and CVE-2026-123549, a privilege-escalation flaw in self-registration.