CVE-2026-123553 OpenAM before 16.1.4 Default Credentials in Built-in Accounts Allow Unauthenticated Login
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123553?
CVE-2026-123553 is a medium-severity vulnerability in OpenIdentityPlatform OpenAM, published on 8 Nov 2026.
Official description
OpenAM before 16.1.4 ships built-in identities in the Top Level Realm (demo, anonymous, wsc, wsp, SecurityTokenService and agentAuth) with passwords that are identical on every installation, publicly known, and able to authenticate. Unauthenticated remote attackers can log in as these identities to obtain authenticated sessions, and the agent identities can read the configuration of other agent profiles.
Weakness: CWE-1392
Which versions are affected by CVE-2026-123553?
How do I fix CVE-2026-123553?
No fix has been published for CVE-2026-123553 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123553 being exploited?
There is no known exploitation of CVE-2026-123553 in the wild and no public exploit code.
Sources
Also known as GHSA-hvfc-4v4r-8p9w, GHSA-j9m3-57qj-x2h4.