Medium severity · published Oct 3, 2026
CVE-2026-105120
OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint
4.9
CVSS
0.3%
EPSS
No
On KEV
Description
OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to list sessions of every realm. Attackers holding delegated RealmAdmin privileges can supply a _queryFilter naming another realm to disclose usernames, universal IDs, and session handles across tenant boundaries.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpenAM · OpenIdentityPlatform
before 16.1.3; before 16.1.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-105120
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-105120
vendor-advisory
https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-x8cj-3hqv-cgwh
third-party-advisory
https://www.vulncheck.com/advisories/openam-before-16.1.3-cross-realm-session-disclosure-via-sessions-rest-endpoint
More from OpenAM
9.8
CVE-2026-62379
OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback
9.8
CVE-2026-33439
Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM
9.8
CVE-2023-37471
Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security
9.3
CVE-2026-46619
OpenAM Authentication Bypass via MSISDN LDAP Injection
9.3
CVE-2026-45052
OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints