Description
OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to read live session tokens from the notification WebSocket. Attackers can bypass the agent-only check through an unvalidated internal forward on legacy Liberty ID-FF endpoints, collecting iPlanetDirectoryPro tokens to hijack user and administrator sessions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenIdentityPlatform | OpenAM | 14.0.0 – < 16.1.4 | 16.1.4 |
References
- GitHub Security Advisory (GHSA-5c3q-hp86-xjr8) vendor-advisory
- VulnCheck Advisory: OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocket third-party-advisory