CVE-2021-4201

Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthenticated attackers to hijack sessions, including potentially admin-level sessions. This issue affects: ForgeRock Access Management 7.1 versions prior to 7.1.1; 6.5 versions prior to 6.5.4; all previous versions.

Published: Feb 14, 2022
Updated: Nov 16, 2025
CVE: CVE-2021-4201
Severity: Critical
Exploit:

CVSS v3:

Severity: Critical
Score: 9.6
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CVSS v2:

Severity: High
Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

OWASP TOP 10:

Affected Software
References

Software	From	Fixed in
forgerock / access_management	5.5.2	5.5.2.x
forgerock / access_management	6.5.0	6.5.0.x
forgerock / access_management	6.5.0.1	6.5.0.1.x
forgerock / access_management	6.5.0.2	6.5.0.2.x
forgerock / access_management	6.5.1	6.5.1.x
forgerock / access_management	6.0.0	6.0.0.x
forgerock / access_management	6.0.0.1	6.0.0.1.x
forgerock / access_management	6.0.0.2	6.0.0.2.x
forgerock / access_management	6.0.0.3	6.0.0.3.x
forgerock / access_management	6.0.0.4	6.0.0.4.x
forgerock / access_management	6.0.0.6	6.0.0.6.x
forgerock / access_management	6.0.0.7	6.0.0.7.x
forgerock / access_management	6.5.2.1	6.5.2.1.x
forgerock / access_management	6.5.2.2	6.5.2.2.x
forgerock / access_management	6.5.2.3	6.5.2.3.x
forgerock / access_management	6.5.3	6.5.3.x
forgerock / access_management	7.0.0	7.0.0.x
forgerock / access_management	7.0.1	7.0.1.x
forgerock / access_management	7.0.2	7.0.2.x
forgerock / access_management	7.1.0	7.1.0.x

https://backstage.forgerock.com/knowledge/kb/article/a50037155#x7ZPA0

Vulnerability Database

308,820

CVE-2021-4201

Deep Security Visibility Without the Complexity