OpenAM CVE-2026-105121

Requires an authenticated OpenAM account that has been granted the iplanet-am-session-destroy-sessions attribute (a delegated-administrator privilege), plus a multi-realm deployment where the attacker's realm differs from the victims' realm. The attacker must also be able to supply a valid target session identifier or handle. Exploitation is LIMITED by this PR:H prerequisite - it is not reachable by unauthenticated users or by ordinary authenticated end users; single-realm deployments and installations that do not delegate the session-destroy privilege are not meaningfully exposed. Impact is restricted to forced logout (availability of user sessions); no confidentiality or integrity impact is indicated.

This is a moderate-priority authorization flaw, not an urgent fire-drill. The reporter-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VA:H only) correctly frames it as a network-reachable but high-privilege issue with availability-only impact: the attacker is an already-authenticated delegated administrator who holds the iplanet-am-session-destroy-sessions attribute, so this is privilege misuse across a trust boundary (CWE-285), not remote unauthenticated compromise. There is no CISA KEV listing and no public exploit was supplied in the intelligence, so exploitation status is 'no public exploit identified at time of analysis' - no EPSS score was provided to corroborate likelihood. The realm-scoping defect is real and verifiable from the vendor GHSA advisory, but real-world risk is bounded by the PR:H prerequisite: an organization is only exposed to the extent that it issues the session-destroy attribute to semi-trusted or compromised delegated admins. No signals conflict; the main gap is the absence of EPSS/KEV/POC data, which is consistent with a recently disclosed, privilege-gated bug rather than a contradiction.

A delegated administrator (or an attacker who has compromised such an account) in one realm of a multi-realm OpenAM deployment supplies a session identifier or handle belonging to users in a different realm and invokes the session-destroy operation. Because the server evaluates realm permission against the requester's own realm rather than the target's, the request succeeds and forcibly logs out arbitrary users across the entire instance. No public proof-of-concept was provided in the intelligence.