CVE-2026-123553 | BDVDB-2026-401910 Detail
OpenIdentityPlatformOpenAM
Description#
OpenAM before 16.1.4 ships built-in identities in the Top Level Realm (demo, anonymous, wsc, wsp, SecurityTokenService and agentAuth) with passwords that are identical on every installation, publicly known, and able to authenticate. Unauthenticated remote attackers can log in as these identities to obtain authenticated sessions, and the agent identities can read the configuration of other agent profiles.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact low, availability impact none. Attack vector: network.
Weaknesses#
- CWE-1392 Use of Default Credentials
References#
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.