CVE-2026-105121CWE-285

CVE-2026-105121

Medium · published October 3, 2026

CVSS v3.1
4.9
EPSS
0%
Percentile
15.7
In the wild
Unconfirmed
What it is

OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their realms because realm checks use the requester's realm. Authenticated accounts holding the iplanet-am-session-destroy-sessions attribute can supply a target session identifier or handle to forcibly log out users in any realm.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00252 · 15.7th percentile
Weakness
CWE-285 · Improper Authorization
Published
2026-10-03T18:16Z
References (2)
https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-hmwh-9r8r-44gw · [email protected]https://www.vulncheck.com/advisories/openam-before-16.1.3-improper-authorization-in-delegated-session-destroy-realm-scoping · [email protected]
EPSS history
Timeline
  • 07 OCT 03:39Z
    EPSS moved — → 0%
    epss
  • 03 OCT 12:14Z
    OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping
    cvelistv5