OpenAM Notification WebSocket Session Disclosure (CVE-2026-123551)

CVE-2026-123551 lets an attacker with no credentials read data from OpenAM's notification WebSocket. OpenAM publishes session events to this WebSocket so policy agents learn when a session starts, ends or changes.

The advisory describes two weaknesses that together expose live session tokens. First, when agent notifications are enabled, which is the default, OpenAM publishes the full session identifier on every session-creation, logout, timeout and property-change event.

Second, the check meant to limit the WebSocket to policy agents can be bypassed without credentials, through an unvalidated internal request forward on a legacy Liberty ID-FF endpoint. Once connected, the advisory says a client can subscribe to any topic, internal ones too.

What CVE-2026-123551 Lets an Attacker Read

An attacker with no credentials who reaches the OpenAM port and holds a WebSocket connection can passively collect a live token. The advisory says this works for every user whose session changes while connected, admins too.

Each leaked token lets the attacker act as that user until the session ends, which the advisory calls an unauthenticated impersonation. If an admin's session is captured, it says the attacker gains a super-user session and can escalate to command execution as the OpenAM service account.

The advisory also notes the collection is passive, with no failed logins or account lockouts. The one precondition the attacker does not control is that a user authenticates while the connection is held. It calls this routine in an operational deployment.

CVSS Score and CWE for CVE-2026-123551

VulnCheck, the CNA, scores CVE-2026-123551 as CVSS v3.1 10.0 Critical, with CVSS v4.0 10.0 Critical as a secondary metric, the highest rating on both scales. The advisory lists the same 10.0 score and does not publish a CVSS v4.0 vector.

The CVE record lists the primary weakness as CWE-201, sensitive data sent to the wrong party. The advisory also maps missing authorization, poorly protected credentials and open redirect flaws closed by the same fix. See our CVSS entry for how to read the score.

What OpenIdentityPlatform and CISA KEV Say

The advisory says OpenAM 16.1.4 is the first fixed release, and releases from 14.0.0 up to and including 16.1.3 are affected. As of CISA catalog version 2026.11.06, CVE-2026-123551 is not in the Known Exploited Vulnerabilities catalog. The advisory and the CVE record do not state whether the flaw has been exploited. Our KEV glossary entry explains the catalog.

The CVE record and the advisory both list OpenAM from 14.0.0 up to and including 16.1.3 as affected. It says releases before 14.0.0 have no notification WebSocket, so they are not exposed.

Fixed in 16.1.4, the advisory says the security filters, the WebSocket's agent-only check included, also run on internal request dispatches. The legacy Liberty ID-FF endpoints no longer forward a request into internal endpoints or hand a session token to another host.

The advisory flags one upgrade-breaking change. A hosted Liberty ID-FF provider gets a Relay State URL List. While it is empty, a redirect destination is accepted only under the deployment's own URLs.

GHSA-5c3q-hp86-xjr8 credits DauHoangTai as the reporter. We recommend rotating current admin and user sessions after the upgrade, as the advisory also suggests, and reading our vulnerability management guide for the rollout.

OpenAM 16.1.4 also fixes two other critical flaws we cover separately: a self-registration attribute bypass, CVE-2026-123549, and a SAML authentication bypass, CVE-2026-123550. Deployments on 16.1.3 or earlier should patch for all three.