CVE-2026-105121 Overview
CVE-2026-105121 is an improper authorization vulnerability [CWE-285] in OpenAM versions prior to 16.1.3. The flaw affects the delegated session destroy functionality, where realm scoping checks reference the requester's realm rather than the target session's realm. Authenticated accounts holding the iplanet-am-session-destroy-sessions attribute can supply a target session identifier or handle and forcibly terminate sessions in any realm. This cross-realm session termination breaks the multi-tenant trust boundary that delegated administration is designed to enforce.
Critical Impact
Delegated administrators can log out users across realm boundaries, enabling denial of service against production authentication sessions and disruption of federated identity services.
Affected Products
- Open Identity Platform OpenAM versions prior to 16.1.3
- Deployments using delegated administration with the iplanet-am-session-destroy-sessions privilege
- Multi-realm OpenAM configurations relying on realm scoping for session management
Discovery Timeline
- 2026-10-03 - CVE-2026-105121 published to the National Vulnerability Database
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-105121
Vulnerability Analysis
OpenAM supports delegated administration through privilege attributes that grant scoped administrative capabilities. The iplanet-am-session-destroy-sessions attribute authorizes an account to invalidate active sessions. The authorization check that enforces realm scoping evaluates the requester's realm context instead of the realm of the target session. As a result, a delegated administrator assigned to one realm can pass a session identifier or session handle belonging to another realm, and the server honors the destroy request. The attacker needs only valid authenticated credentials with the delegated destroy privilege and knowledge or capture of a target session identifier.
Root Cause
The root cause is an improper authorization check [CWE-285] in the session destroy code path. Realm boundary validation compares the caller's realm attributes against the privilege definition rather than resolving the target session's owning realm. OpenAM 16.1.3 corrects the check so that realm scoping evaluates the realm of the session being destroyed.
Attack Vector
Exploitation requires network access to the OpenAM administrative interface and valid authentication as an account carrying the destroy-sessions privilege. The attacker supplies a target session identifier or session handle for a user in a different realm through the session management API. The server destroys the session without re-evaluating realm ownership. Impact is limited to availability of user sessions; confidentiality and integrity of session data are not directly affected. Refer to the GitHub Security Advisory GHSA-hmwh-9r8r-44gw for implementation specifics.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-105121
Indicators of Compromise
- Session destroy events in OpenAM audit logs where the acting administrator's realm does not match the destroyed session's realm.
- Unexpected spikes in forced logout events or user re-authentication across unrelated realms.
- Help desk reports of users unexpectedly logged out of federated applications served by OpenAM.
Detection Strategies
- Correlate OpenAM AM-SESSION-DESTROY audit events with the realm attributes of both the requester principal and the affected session subject.
- Baseline normal delegated administrator activity per realm and alert on cross-realm destroy operations.
- Flag accounts holding the iplanet-am-session-destroy-sessions attribute that interact with session identifiers outside their assigned realm.
Monitoring Recommendations
- Forward OpenAM access and audit logs to a centralized analytics platform for cross-realm correlation.
- Monitor API calls to session management endpoints with high-frequency destroy requests from a single principal.
- Track changes to delegated administration privilege assignments, specifically the destroy-sessions attribute.
How to Mitigate CVE-2026-105121
Immediate Actions Required
- Upgrade OpenAM to version 16.1.3 or later, which enforces realm scoping against the target session.
- Inventory all principals assigned the iplanet-am-session-destroy-sessions attribute and remove unnecessary grants.
- Rotate credentials for delegated administrator accounts if cross-realm destroy activity is observed in logs.
Patch Information
Open Identity Platform resolved CVE-2026-105121 in OpenAM 16.1.3. The fix changes the realm scoping check in the session destroy path so that authorization resolves against the realm of the targeted session. See the VulnCheck Advisory on OpenAM and the GitHub Security Advisory GHSA-hmwh-9r8r-44gw for upgrade guidance.
Workarounds
- Restrict the iplanet-am-session-destroy-sessions attribute to a minimal set of trusted global administrators until the upgrade completes.
- Segregate high-value realms onto dedicated OpenAM instances to limit cross-realm exposure during the patching window.
- Enable strict audit logging on session destroy operations and alert on anomalous use pending the upgrade.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
