CVE-2021-4201: ForgeRock Access Management

Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days.

Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthenticated attackers to hijack sessions, including potentially admin-level sessions. This issue affects: ForgeRock Access Management 7.1 versions prior to 7.1.1; 6.5 versions prior to 6.5.4; all previous versions.

Affected products

• ForgeRock Access Management: version 5.5.2 only; version 6.0.0 only; version 6.0.0.1 only; version 6.0.0.2 only; version 6.0.0.3 only; version 6.0.0.4 only; …

Published 2022-02-14. Last modified 2026-06-17.