CVE-2026-105121: OpenAM improper authorization in delegated session-destroy

CVE-2026-105121 · Severity: medium · CVSS 4.9 · Published 2026-10-03

OpenAM is an identity and access management platform that administrators use to control user sessions and permissions. A flaw in the delegated session-destroy feature allows authenticated administrative accounts to forcibly log out users in any realm, even ones they were not authorized to manage. This can be exploited by accounts that hold the session-destroy delegation right, causing denial of service to users across the platform.

Technologies: Open Identity Platform OpenAM. Vendors: Open Identity Platform.

Quick answers

Is CVE-2026-105121 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-105121 being exploited in the wild.
How severe is CVE-2026-105121?
Medium severity, with a CVSS score of 4.9, published 3 October 2026.
Which products and versions are affected?
Open Identity Platform OpenAM before 16.1.3.
Is there a fix for CVE-2026-105121?
Yes: fixed in OpenAM 16.1.3. Until then: Search the identity store for accounts carrying the iplanet-am-session-destroy-sessions attribute and remove it wherever the account does not strictly need to destroy other users' sessions. Until 16.1.3 is deployed, treat the attribute as granting session-destroy rights in every realm, not only the listed ones. Monitor audit logs for session-destroy operations performed by delegated accounts and alert when such an account terminates sessions outside the realms it was delegated. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105121 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-105121?
Check whether you run Open Identity Platform OpenAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: OpenAM 16.1.3

Search the identity store for accounts carrying the iplanet-am-session-destroy-sessions attribute and remove it wherever the account does not strictly need to destroy other users' sessions. Until 16.1.3 is deployed, treat the attribute as granting session-destroy rights in every realm, not only the listed ones. Monitor audit logs for session-destroy operations performed by delegated accounts and alert when such an account terminates sessions outside the realms it was delegated.

Technical details

The vulnerability is an improper authorization flaw (CWE-285) in the realm-scoping logic of the delegated session-destroy feature. When checking whether a delegated administrator can destroy a session, the code evaluates the requester's own realm rather than the target session's realm, bypassing the intended realm restrictions. An authenticated attacker holding the iplanet-am-session-destroy-sessions attribute can supply any session identifier or handle to destroy sessions in realms outside their delegation scope.

Affected products

  • Open Identity Platform OpenAM before 16.1.3

Timeline

  • 2026-09-18: disclosed
  • 2026-10-03: advisory
  • 2026-10-03: patched: OpenAM 16.1.3 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.