CVE-2026-123553: Security vulnerability

Published Nov 8, 2026

Updated

OpenAM before 16.1.4 ships built-in identities in the Top Level Realm (demo, anonymous, wsc, wsp, SecurityTokenService and agentAuth) with passwords that are identical on every installation, publicly known, and able to authenticate. Unauthenticated remote attackers can log in as these identities to obtain authenticated sessions, and the agent identities can read the configuration of other agent profiles.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenAM to a version that resolves this vulnerability.
Fixed in 16.1.4

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

OpenAM deployments before 16.1.4 are exposed if the built-in Top Level Realm identities are present and can authenticate. The affected identities are demo, anonymous, wsc, wsp, SecurityTokenService, and agentAuth.

What does an attacker need to exploit this issue?

An attacker only needs network access to the OpenAM authentication service and the publicly known password for a built-in identity. No prior authentication is required.

What access can an attacker obtain?

An attacker can authenticate as a built-in identity and obtain an authenticated session. The agent identities can also read configuration for other agent profiles.

How can I determine whether my deployment is affected?

Check whether the listed built-in identities exist in the Top Level Realm, are enabled for authentication, and retain their installation-default passwords. Deployments running a version before 16.1.4 should be treated as affected based on the available information.

CVE-2026-123553: Security vulnerability

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What access can an attacker obtain?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What access can an attacker obtain?

How can I determine whether my deployment is affected?