# CVE-2026-123553: OpenAM default credentials authentication bypass in built-in identities

Source: https://junglewise.ai/threats/cve-2026-123553-openam-before-16-1-4-ships-built-in-identities-in-the-top-level  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-123553 · Severity: medium · CVSS 6.5 · Published 2026-11-08

OpenAM is an identity and access management platform that controls authentication and authorization for enterprise applications. Versions before 16.1.4 ship with built-in user accounts (demo, anonymous, and service agent profiles) that have publicly known, unchanging default passwords, allowing any unauthenticated attacker to log in remotely and obtain authenticated sessions. These default accounts can be used to read configuration of other agent profiles and serve as a foothold for further attacks within the system.

Technologies: [Open Identity Platform OpenAM](https://junglewise.ai/threats/technologies/openam). Vendors: [Open Identity Platform](https://junglewise.ai/threats/vendors/open-identity-platform).

## Quick answers

**Is CVE-2026-123553 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123553 being exploited in the wild.

**How severe is CVE-2026-123553?** Medium severity, with a CVSS score of 6.5, published 8 November 2026.

**Which products and versions are affected?** Open Identity Platform OpenAM before 16.1.4.

**Is there a fix for CVE-2026-123553?** Yes: fixed in OpenAM 16.1.4. Until then: Until 16.1.4 is deployed, remove the demo user and agent profiles (wsc, wsp, SecurityTokenService, agentAuth) from the Top Level Realm, or give each a strong custom password and ensure they are deactivated. Additionally, enable account lockout with a non-zero Login Failure Lockout Duration under Realms > Realm > Authentication > Settings, and disable Module Based Authentication under Realms > Realm > Authentication > Settings > Security if not required. Give the anonymous user a strong custom password. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123553 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-123553?** Check whether you run Open Identity Platform OpenAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in OpenAM 16.1.4

Until 16.1.4 is deployed, remove the demo user and agent profiles (wsc, wsp, SecurityTokenService, agentAuth) from the Top Level Realm, or give each a strong custom password and ensure they are deactivated. Additionally, enable account lockout with a non-zero Login Failure Lockout Duration under Realms > Realm > Authentication > Settings, and disable Module Based Authentication under Realms > Realm > Authentication > Settings > Security if not required. Give the anonymous user a strong custom password.

## Technical details

OpenAM before 16.1.4 ships multiple built-in identities (demo user, anonymous user, and WS-Security agent profiles: wsc, wsp, SecurityTokenService, agentAuth) in the Top Level Realm with identical, publicly known default passwords across all installations. An unauthenticated remote attacker can exploit this via the OpenAM login endpoints to obtain authenticated sessions; the attack is made easier by disabled account lockout and enabled module-based authentication that allow direct targeting of authentication modules. The agent identities additionally permit reading configuration of other agent profiles once authenticated.

## Affected products

- Open Identity Platform OpenAM before 16.1.4

## Timeline

- 2026-10-22: disclosed
- 2026-11-08: advisory

## References

- [https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-hvfc-4v4r-8p9w](https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-hvfc-4v4r-8p9w)
- [https://www.vulncheck.com/advisories/openam-before-16.1.4-default-credentials-in-built-in-accounts-allow-unauthenticated-login](https://www.vulncheck.com/advisories/openam-before-16.1.4-default-credentials-in-built-in-accounts-allow-unauthenticated-login)

## Related threats

- [OpenAM unauthenticated session token disclosure via WebSocket](https://junglewise.ai/threats/cve-2026-123551-openam-from-14-0-0-before-16-1-4-contains-an-information)
- [OpenAM SAML v2.0 service provider authentication bypass](https://junglewise.ai/threats/cve-2026-123550-openam-before-16-1-4-contains-an-authentication-bypass)
- [OpenAM self-registration attribute list enforcement bypass](https://junglewise.ai/threats/cve-2026-123549-openam-before-16-1-4-fails-to-enforce-the-valid-creation)
- [OpenAM open redirect via SAML RelayState](https://junglewise.ai/threats/cve-2026-123547-openam-before-16-1-4-contains-an-open-redirect-vulnerability)
- [OpenAM open redirect and cross-site scripting in goto parameter](https://junglewise.ai/threats/cve-2026-123546-openam-before-16-1-4-contains-an-open-redirect-and-cross-site)