An information disclosure issue allows unauthenticated attackers to read live session tokens from the notification WebSocket. This is achieved by bypassing the agent-only check via an unvalidated internal forward on legacy Liberty ID-FF endpoints, enabling the collection of `iPlanetDirectoryPro` tokens to hijack user and administrator sessions.