CVE-2026-105121 describes an improper authorization vulnerability in OpenIdentityPlatform's OpenAM product prior to version 16.1.3. The flaw allows delegated administrators, who have the iplanet-am-session-destroy-sessions attribute, to destroy sessions outside their own realms. This is due to realm checks incorrectly using the requester's realm instead of verifying the target session's realm, enabling cross-realm session destruction.

An attacker with delegated administrator privileges and the specific session destroy attribute can forcibly log out users in any realm, not just their own. This could disrupt user sessions across realms, potentially causing denial of service for affected users. There is no indication of privilege escalation beyond session destruction or data compromise from the provided data.

A fix is available in OpenAM version 16.1.3. Users should upgrade to version 16.1.3 or later to remediate this vulnerability. No additional mitigation guidance is provided or required beyond applying the official fix.