CVE-2026-105121

OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping

State: Published
Severity: 6.9 Medium
Published: Oct 3, 2026
Updated: Oct 5, 2026
Reserved: Oct 3, 2026

Description

OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their realms because realm checks use the requester's realm. Authenticated accounts holding the iplanet-am-session-destroy-sessions attribute can supply a target session identifier or handle to forcibly log out users in any realm.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	4.9 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H	VulnCheck

Weaknesses

CWE-285 Improper Authorization

Affected Products

Product	Versions
OpenAMOpenIdentityPlatform	before 16.1.3Affected 16.1.3Not affected

References

GitHub Security Advisory (GHSA-hmwh-9r8r-44gw)vendor-advisory
VulnCheck Advisory: OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scopingthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.