Improper Authorization Vulnerability in OpenAM by ForgeRock
CVE-2026-105121

6.9MEDIUM

Key Information:

Vendor

Openidentityplatform

Status
Openam
Vendor
CVE Published:
3 October 2026

What is CVE-2026-105121?

OpenAM prior to version 16.1.3 is impacted by an improper authorization vulnerability that permits delegated administrators to terminate user sessions in realms they do not control. This occurs due to a flaw in realm validation, where checks are only based on the requester's realm. Administrators with specific session destruction permissions can manipulate session identifiers to forcibly log users out from any realm, raising significant security concerns regarding unauthorized access and session hijacking.

Affected Version(s)

OpenAM 0 < 16.1.3

OpenAM 16.1.3

References

https://github.com/OpenIdentityPlatform/OpenAM/security/a...
vendor-advisory
https://www.vulncheck.com/advisories/openam-before-16.1.3...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

arpitjain099
maximthomas
tsujiguchitky
.