Threats tagged 'ghsa-j9m3-57qj-x2h4'

OpenAM versions prior to 16.1.4 include built-in identities in the Top Level Realm with default passwords that are identical across all installations and publicly known. These default credentials allow unauthenticated remote attackers to log in as these identities and obtain authenticated sessions. Additionally, agent identities can access configuration details of other agent profiles.