4.9
MediumCVSS 3.1 · from VulnCheck
CVE-2026-105121
OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping
OpenAM · CWE-285 · CWE-285AffectedOpenAM
FixUpdate to 16.1.3 or newer
PublishedOct 3, 12:14 · VulnCheck
ScoredOct 3 · 4.9 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:05 UTC
What we know
No known exploitation. CISA KEV, checked 22:05 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, high privileges.
A successful attack can take the service down. CVSS impact.
Description
OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their realms because realm checks use the requester's realm. Authenticated accounts holding the iplanet-am-session-destroy-sessions attribute can supply a target session identifier or handle to forcibly log out users in any realm.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed inOpenAMbefore 16.1.316.1.3OpenAMNot affected16.1.3
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known