What’s Vulnerable › Vulnerabilities

CVE-2026-105120: OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint

• Severity: medium (CVSS 4.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-03 · updated 2026-10-06
• Weakness: CWE-200

Description

OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to list sessions of every realm. Attackers holding delegated RealmAdmin privileges can supply a _queryFilter naming another realm to disclose usernames, universal IDs, and session handles across tenant boundaries.

Affected products

• OpenIdentityPlatform OpenAM: before 16.1.3 — fixed in 16.1.3

How to fix

Upgrade to a fixed version: OpenIdentityPlatform OpenAM 16.1.3. Check the vendor advisory for mitigations.

References

• https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-x8cj-3hqv-cgwh
• https://www.vulncheck.com/advisories/openam-before-16.1.3-cross-realm-session-disclosure-via-sessions-rest-endpoint

Get alerted when CVE-2026-105120 or the next vulnerability affects your stack