OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping
OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their realms because realm checks use the requester's realm. Authenticated accounts holding the iplanet-am-session-destroy-sessions attribute can supply a target session identifier or handle to forcibly log out users in any realm.
CVE-2026-105121
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-105121
OpenAM
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "OpenIdentityPlatform",
"product": "OpenAM",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "16.1.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "16.1.3",
"versionType": "semver"
}
],
"packageURL": "pkg:maven/org.openidentityplatform.openam/openam-core",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-105121
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #8936 · Revision 1
- Added to Heist Feed
- Publisher date