CVE-2026-123553

OpenAM versions before 16.1.4 are vulnerable to a default credentials flaw. The software ships built-in identities within the Top Level Realm —specifically demo , anonymous , wsc , wsp , SecurityTokenService , and agentAuth —with publicly known, identical passwords across all installations. This ...