CVE-2026-105121
Received Received - Intake

Improper Authorization in OpenAM Leading to Session Destruction

Publication date: 2026-10-03

Last updated on: 2026-10-03

Assigner: VulnCheck

Description
OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their realms because realm checks use the requester's realm. Authenticated accounts holding the iplanet-am-session-destroy-sessions attribute can supply a target session identifier or handle to forcibly log out users in any realm.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-03
Last Modified
2026-10-03
Generated
2026-10-03
AI Q&A
2026-10-03
EPSS Evaluated
N/A
NVD
CVE-2026-105121
EUVD
EUVD-2026-92025

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
forgerock openam to 16.1.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenAM before version 16.1.3 has an improper authorization flaw where delegated administrators with the iplanet-am-session-destroy-sessions attribute can destroy sessions outside their assigned realms. The system incorrectly uses the requester's realm instead of the target session's realm for validation, allowing authenticated users to forcibly log out users in any realm by providing a session identifier or handle.

Detection Guidance

To detect this vulnerability, review OpenAM logs for session-destroy operations initiated by delegated administrators. Check if any session destruction events occur outside the requester's assigned realm. Look for accounts with the iplanet-am-session-destroy-sessions attribute performing actions beyond their realm scope.

Impact Analysis

This vulnerability allows unauthorized session termination, disrupting user availability and legitimate operations. Attackers with delegated rights can log out users across any realm, potentially causing denial of service or interfering with administrative tasks. The impact is limited to availability, with no direct confidentiality or integrity risks.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized session termination, which may disrupt user access to systems handling sensitive data. GDPR requires ensuring data integrity and availability, while HIPAA mandates access controls to protect patient information. Unauthorized session destruction could interfere with legitimate operations and violate these requirements.

Mitigation Strategies

Immediately upgrade OpenAM to version 16.1.3 or later to enforce proper realm scoping for session destruction. Temporarily revoke the iplanet-am-session-destroy-sessions attribute from delegated administrators until the upgrade is complete. Monitor session-destroy operations closely and restrict access to session identifiers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105121. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart