{"id":12555,"date":"2026-11-10T18:36:18","date_gmt":"2026-11-11T00:36:18","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-156-session-token-disclosure-and-other-critical-flaws-in-openam\/"},"modified":"2026-11-10T18:55:48","modified_gmt":"2026-11-11T00:55:48","slug":"alert-2026-156-session-token-disclosure-and-other-critical-flaws-in-openam","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-156-session-token-disclosure-and-other-critical-flaws-in-openam\/","title":{"rendered":"Alert 2026-156 Session token disclosure and other critical flaws in OpenAM"},"content":{"rendered":"\n

Affected product(s):<\/h2>\n\n
CVE<\/strong><\/td>Affected versions<\/strong><\/td>Fixed in<\/strong><\/td><\/tr>
CVE-2026-123551<\/strong><\/td>14.0.0 through 16.1.3 inclusive (before 14.0.0 there is no notifications WebSocket)<\/td>16.1.4 (Oct 22, 2026)<\/td><\/tr>
CVE-2026-123549<\/strong><\/td>All versions up to 16.1.3 inclusive, in realms with self-registration enabled (disabled by default)<\/td>16.1.4<\/td><\/tr>
CVE-2026-123550<\/strong><\/td>All versions up to 16.1.3 inclusive, when OpenAM acts as a SAML v2.0 service provider and the three conditions in the advisory are met<\/td>16.1.4<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

Product: OpenIdentityPlatform OpenAM. Version 16.1.4, released on Oct 22, 2026, is the recommended version and, as of Nov 10, 2026, remains the latest.<\/p>\n\n

Description<\/h2>\n\n

Three critical vulnerabilities have been published in OpenIdentityPlatform OpenAM. The vendor released the fix on Oct 22, 2026 in version 16.1.4, which as of Nov 10, 2026 remains the latest; the CVE identifiers were made public on Nov 7, 2026. This advisory focuses on those three flaws; the same 16.1.4 also addresses other advisories of lesser or different severity, listed in the release notes.<\/p>\n\n

The most severe is CVE-2026-123551. OpenAM publishes session events on a notifications WebSocket that, with the default configuration, include the session ID, which is a credential. The control that should restrict that channel to agents can be bypassed without authentication. According to the vendor, an attacker who reaches the OpenAM port can collect live tokens from users and administrators\u2014collection is passive as long as there is session activity\u2014and impersonate them to OpenAM and to the applications that rely on it for single sign-on. If an administrator session is captured, the manufacturer describes a superuser level of impact that can go as far as taking control of the configuration and executing commands on the server using the service account; this is not a remote code execution independent of the theft of that session. Agent notifications are enabled by default, and federation, self-service, or configured agents are not required for the weaknesses to be present. The manufacturer and the CVE record rate it with CVSS 3.1 10.0, critical; the record adds a CVSS 4.0 10.0, also critical. It affects versions 14.0.0 through 16.1.3 inclusive; versions earlier than 14.0.0 do not have that WebSocket.<\/p>\n\n

The manufacturer scores CVE-2026-123549 and CVE-2026-123550 with CVSS 3.1 9.8, critical; the CVE record confirms that 9.8 and adds a CVSS 4.0 9.3, critical. In the first one, self-registration does not fully enforce the allowlist of attributes: an anonymous attacker can set restricted attributes, including group membership, and enter an administrative group. It affects the legacy self-service REST endpoint and the current User Self-Service flow. Self-registration is disabled by default; only installations where it is enabled in some realm are affected. The range is all versions up to 16.1.3 inclusive, not from 14.0.0 onward.<\/p>\n\n

CVE-2026-123550 applies when OpenAM acts as a SAML v2.0 service provider: it may accept unsigned assertions in some bindings and issue a session as the named user, including administrators. The manufacturer specifies that three conditions must occur together: the metadata advertises the ECP\/PAOS consumer (it does so by default); Assertions Signed \/ WantAssertionsSigned is set to false (also the default value of the generated metadata); and the service provider has an encryption key configured (this is chosen by the administrator and is not part of the default configuration). Installations that do not act as a SAML v2.0 service provider are not affected. The range is, again, all versions up to 16.1.3 inclusive.<\/p>\n\n

No known exploitation or public proof of concept was identified. The manufacturer deliberately withheld the technical details and proof-of-concept code to allow time for updates. As of Nov 10, 2026, these three flaws are not listed in catalogs of known exploited vulnerabilities.<\/p>\n\n

Mitigation<\/h2>\n\n

It is recommended to inventory the OpenIdentityPlatform OpenAM instances and their versions, and update to 16.1.4. Meanwhile, apply the vendor’s mitigations: restrict \/openam\/notifications and \/openam\/ws\/* to trusted agents’ hosts only; block the legacy Liberty ID-FF endpoints (\/openam\/preLogin and \/openam\/postLogin) if they are not used; and, if agent notifications are not needed, disable them using the property documented by the vendor. Disable self-registration in realms that do not need it; if it must remain, turn off the legacy flow and reject attributes outside the allowlist. In SAML v2.0 service providers, require signed assertions, remove ECP if it is not used, and do not leave an encryption key configured if it is not needed.<\/p>\n\n

After updating, or if exposure is suspected, treat current sessions\u2014especially administrator sessions\u2014as potentially exposed: invalidate them (a token already obtained remains valid until it expires) and rotate administrator credentials. Review privileged group memberships of accounts created through self-registration, as well as the SAML single sign-on configuration and logs, particularly for the ECP binding on privileged accounts. The manufacturer also advises monitoring WebSocket connections to \/notifications that do not come from known agents. Follow the upgrade notes (Relay State list in ID-FF, Valid Creation Attributes list and WantAssertionsSigned in HTTP-Artifact federations) to avoid breaking legitimate federation or self-registration; in HTTP-Artifact federations with the default values, it is advisable to set WantAssertionsSigned to true before updating.<\/p>\n\n

These measures do not replace the patch. The patch does not eliminate a previous compromise. The manufacturer did not publish indicators of compromise.<\/p>\n\n

Solution<\/h2>\n\n

The solution is to update OpenIdentityPlatform OpenAM to version 16.1.4 on all affected instances, invalidate active sessions, review privileged group memberships and the SAML configuration, and meanwhile apply the network and feature restrictions indicated by the manufacturer.<\/p>\n\n

For information on how to update, visit the following link:<\/p>\n\n

https:\/\/doc.openidentityplatform.org\/openam\/release-notes\/release-16.1.4<\/a><\/p>\n\n

Additional information:<\/h2>\n\n