CVE-2026-123553

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.4

Description Built-in identities in the Top Level Realm, specifically demo, anonymous, wsc, wsp, SecurityTokenService, and agentAuth, are shipped with identical, publicly known passwords across all installations. This allows unauthenticated remote attackers to log in as these identities to obtain authenticated sessions. Furthermore, the agent identities can be used to read the configuration of other agent profiles.

Recommendations Update to version 16.1.4 or later.