CVE-2026-105121

OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their realms because realm checks use the requester's realm. Authenticated accounts holding the iplanet-am-session-destroy-sessions attribute can supply a target...

EUVD-2026-92025

OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their realms because realm checks use the requester's realm. Authenticated accounts holding the iplanet-am-session-destroy-sessions attribute can supply a target...

CVE-2026-105121

Versions of OpenAM before 16.1.3 are affected by an improper authorization vulnerability. The root cause is that realm checks incorrectly use the requester's realm, allowing delegated administrators to bypass intended scoping. Authenticated accounts possessing the iplanet-am-session-destroy-sessi...

CVE-2026-105121 OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping

OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their realms because realm checks use the requester's realm. Authenticated accounts holding the iplanet-am-session-destroy-sessions attribute can supply a target...

CVE-2026-105121: Improper Authorization

OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their realms because realm checks use the requester's realm. Authenticated accounts holding the iplanet-am-session-destroy-sessions attribute can supply a target...

PT-2026-104582

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description An improper authorization issue exists where delegated administrators can destroy sessions outside their assigned realms. This occurs because realm checks are performed using the requester's realm...

PT-2024-16552

Name of the Vulnerable Software and Affected Versions WP Activity Log plugin for WordPress versions up to, and including, 5.2.1 Description The issue is related to Stored Cross-Site Scripting via the user id parameter due to insufficient input sanitization and output escaping. This allows...