CVE-2026-123553

OpenAM before 16.1.4 Default Credentials in Built-in Accounts Allow Unauthenticated Login

6.9 Medium

OpenAM before 16.1.4 ships built-in identities in the Top Level Realm (demo, anonymous, wsc, wsp, SecurityTokenService and agentAuth) with passwords that are identical on every installation, publicly known, and able to authenticate. Unauthenticated remote attackers can log in as these identities to obtain authenticated sessions, and the agent identities can read the configuration of other agent profiles.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.25%Scored on 2026-11-08. The trend appears after a second daily score.

What each source reports

CVE List Score used 6.9

OpenAM before 16.1.4 Default Credentials in Built-in Accounts Allow Unauthenticated Login

Record: CVE-2026-123553
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-1392
Updated: 2026-11-08

EUVDEUVD-2026-119438 6.9

Record: EUVD-2026-119438
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-08

GitHub AdvisoriesGHSA-j9m3-57qj-x2h4 6.9

OpenAM before 16.1.4 ships built-in identities in the Top Level Realm (demo, anonymous, wsc, wsp,...

Record: GHSA-j9m3-57qj-x2h4
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-1392
Updated: 2026-11-08

NVD 6.9

Record: CVE-2026-123553
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-1392
Updated: 2026-11-08

OSV 6.9

OpenAM before 16.1.4 Default Credentials in Built-in Accounts Allow Unauthenticated Login

Record: CVE-2026-123553
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-1392
Updated: 2026-11-08

Affected products

openidentityplatform openam

History

History
Recorded	Changed	Sources
Nov 8, 2026	aliases, references	NVD, OSV
Nov 8, 2026	published	EUVD
Nov 8, 2026	published	EUVD
Nov 8, 2026	aliases, references	GitHub Advisories
Nov 8, 2026	aliases, published	EUVD
Nov 8, 2026	first indexed	CVE List

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-123553 is a medium vulnerability (CVSS 6.9) in Openidentityplatform Openam, published November 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. No source names a fixed version.