CVE-2026-105120CWE-200information-disclosure

CVE-2026-105120

Medium · published October 3, 2026

CVSS v3.1
4.9
EPSS
0%
Percentile
17.3
In the wild
Unconfirmed
What it is

OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to list sessions of every realm. Attackers holding delegated RealmAdmin privileges can supply a _queryFilter naming another realm to disclose usernames, universal IDs, and session handles across tenant boundaries.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00264 · 17.3th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-10-03T18:16Z
References (2)
https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-x8cj-3hqv-cgwh · [email protected]https://www.vulncheck.com/advisories/openam-before-16.1.3-cross-realm-session-disclosure-via-sessions-rest-endpoint · [email protected]
EPSS history
Timeline
  • 07 OCT 03:39Z
    EPSS moved — → 0%
    epss
  • 03 OCT 12:14Z
    OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint
    cvelistv5