CVE-2026-105120

MEDIUMCVSS 4.9

Description

OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to list sessions of every realm. Attackers holding delegated RealmAdmin privileges can supply a _queryFilter naming another realm to disclose usernames, universal IDs, and session handles across tenant boundaries.

Timeline

Published:October 3rd, 2026 2:16 PM

Last modified:October 5th, 2026 5:17 PM

CVSS Scoring

CVSS v3: 4.9 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-200

References & Reports

Advisories, patches, and third-party reports

https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-x8cj-3hqv-cgwh
https://www.vulncheck.com/advisories/openam-before-16.1.3-cross-realm-session-disclosure-via-sessions-rest-endpoint

Source: NIST NVD · Data may lag official sources by up to one minute