CriticalCVSS10.02026-11-09
CVE-2026-123551 — OpenAM notification WebSocket lets unauthenticated attackers read session tokens: explainer and fix (CVSS 10.0, fixed in 16.1.4)
Flaw in Open Identity Platform OpenAM 14.0.0 up to (not including) 16.1.4, CVSS 10.0. Per the advisory, the notification WebSocket's authentication check can be bypassed, so an unauthenticated attacker can collect session tokens and hijack user and administrator sessions. Fixed in 16.1.4. The advisory reports no exploitation and the flaw is not in CISA KEV as of 9 November. This site's view: updating is not enough; existing sessions must be revoked after the update.