Medium severity6.5NVD Advisory· Published Nov 8, 2026

CVE-2026-123553

Description

OpenAM before 16.1.4 ships built-in identities in the Top Level Realm (demo, anonymous, wsc, wsp, SecurityTokenService and agentAuth) with passwords that are identical on every installation, publicly known, and able to authenticate. Unauthenticated remote attackers can log in as these identities to obtain authenticated sessions, and the agent identities can read the configuration of other agent profiles.

Affected products

Openidentityplatform/Openamllm-fuzzy
Range: <16.1.4

Patches

Vulnerability mechanics

References

github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-hvfc-4v4r-8p9wnvd
www.vulncheck.com/advisories/openam-before-16.1.4-default-credentials-in-built-in-accounts-allow-unauthenticated-loginnvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000