CVE-2026-105121: OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping
OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their realms because realm checks use the requester's realm. Authenticated accounts holding the iplanet-am-session-destroy-sessions attribute can supply a target session identifier or handle to forcibly log out users in any realm.
Affected Software
Event History
Frequently Asked Questions
Which accounts can exploit this issue?
An attacker must be authenticated and hold the iplanet-am-session-destroy-sessions attribute. Delegated administrators with that attribute can target sessions outside the realm in which they are delegated.
What is the practical impact of exploitation?
The attacker can provide a target session identifier or handle and forcibly destroy a user session in any realm. This causes logout and availability disruption; the supplied severity vector indicates no confidentiality or integrity impact.
Are standard users or unauthenticated attackers affected?
No. Exploitation requires an authenticated account with the specific session-destroy privilege, so unauthenticated users and accounts without that attribute cannot use this flaw based on the provided information.
What versions need remediation?
ForgeRock OpenAM versions before 16.1.3 are affected. Update to 16.1.3 or later.
What can be done while patching is delayed?
Review and restrict assignment of the iplanet-am-session-destroy-sessions attribute, particularly for delegated administrators. Limit that privilege to accounts that genuinely require session-destruction capability.