CVE-2026-105120

OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint

CVSS 4.0 6.9 MEDIUMCVSS 3.1 4.9 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-105120

Published

OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to list sessions of every realm. Attackers holding delegated RealmAdmin privileges can supply a _queryFilter naming another realm to disclose usernames, universal IDs, and session handles across tenant boundaries.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-105120

Published

OpenAM

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "OpenIdentityPlatform",
                    "product": "OpenAM",
                    "defaultStatus": "unaffected",
                    "packageURL": "pkg:maven/org.openidentityplatform.openam/openam-core",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "versionType": "semver",
                            "lessThan": "16.1.3"
                        },
                        {
                            "version": "16.1.3",
                            "status": "unaffected",
                            "versionType": "semver"
                        }
                    ]
                }

OpenAM

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "OpenIdentityPlatform",
                    "product": "OpenAM",
                    "defaultStatus": "unaffected",
                    "packageURL": "pkg:maven/org.openidentityplatform.openam/openam-core-rest",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "versionType": "semver",
                            "lessThan": "16.1.3"
                        },
                        {
                            "version": "16.1.3",
                            "status": "unaffected",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON