Medium severity · published Oct 3, 2026
CVE-2026-105121
OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping
4.9
CVSS
0.3%
EPSS
No
On KEV
Description
OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their realms because realm checks use the requester's realm. Authenticated accounts holding the iplanet-am-session-destroy-sessions attribute can supply a target session identifier or handle to forcibly log out users in any realm.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpenAM · OpenIdentityPlatform
before 16.1.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-105121
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-105121
vendor-advisory
https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-hmwh-9r8r-44gw
third-party-advisory
https://www.vulncheck.com/advisories/openam-before-16.1.3-improper-authorization-in-delegated-session-destroy-realm-scoping
More from OpenAM
9.8
CVE-2026-62379
OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback
9.8
CVE-2026-33439
Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM
9.8
CVE-2023-37471
Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security
9.3
CVE-2026-46619
OpenAM Authentication Bypass via MSISDN LDAP Injection
9.3
CVE-2026-45052
OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints