CVE-2026-123553: medium-severity vulnerability in OpenIdentityPlatform OpenAM
OpenAM before 16.1.4 Default Credentials in Built-in Accounts Allow Unauthenticated Login
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.9epss 0.3%
OpenAM before 16.1.4 ships built-in identities in the Top Level Realm (demo, anonymous, wsc, wsp, SecurityTokenService and agentAuth) with passwords that are identical on every installation, publicly known, and able to authenticate. Unauthenticated remote attackers can log in as these identities to obtain authenticated sessions, and the agent identities can read the configuration of other agent profiles.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
OpenIdentityPlatform · OpenAMRelated CVEs — OpenIdentityPlatform OpenAM
In the same product, most dangerous first.
CVE-2026-33439CRITICALPre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAMEPSS 9.3%CVE-2024-41667HIGHOpenAM FreeMarker template injectionEPSS 3.5%CVE-2023-37471CRITICALUser impersonation using SAMLv1.x SSO in Open Access Management EPSS 1.3%CVE-2026-62379CRITICALOpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallbackEPSS 1.1%CVE-2026-46619CRITICALOpenAM Authentication Bypass via MSISDN LDAP InjectionEPSS 1.0%CVE-2026-62263CRITICALOpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypassEPSS 0.9%