CVE-2026-45048

8.5 Élevée

Publiée le 15/09/2026 à 12:17 · Modifiée le 23/09/2026 à 20:19 · En attente d'analyse NVD · Source : security-advisories@github.com

Description

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session management endpoint does not enforce ownership or privilege checks when a low-privileged authenticated user queries session information in deployments using stateful session storage. A requester who knows a target identity identifier can retrieve another user's active session credentials, including credentials for a more privileged account, and use them to hijack that session. This issue is fixed in version 16.1.1.

Traduire en français

Produits concernés

OpenIdentityPlatform OpenAM

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.5 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-200
CWE-285

Références

https://github.com/OpenIdentityPlatform/OpenAM/commit/f775b42236b3cb94e3a02a19f4a4f4f5cc0b91c4
https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1
https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-vvhj-w2jq-263q

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories