CVE-2026-105120 in OpenAM
Summary
by MITRE • 10/03/2026
OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to list sessions of every realm. Attackers holding delegated RealmAdmin privileges can supply a _queryFilter naming another realm to disclose usernames, universal IDs, and session handles across tenant boundaries.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/03/2026
The identified vulnerability resides within the OpenAM authentication and access management platform, specifically affecting versions prior to 16.1.3. It is classified as an authorization bypass that impacts the sessions REST endpoint query operation. This flaw allows individuals with delegated RealmAdmin privileges for a specific realm to escalate their scope of influence beyond their assigned boundaries. By manipulating input parameters in API requests, these users can access session data belonging to other realms within the same OpenAM instance, effectively breaking down multi-tenant isolation mechanisms that are critical for secure identity management architectures.
The technical root cause involves insufficient validation of the _queryFilter parameter used during REST API calls against the sessions endpoint. In a properly secured implementation, this filter should be strictly bound to the context of the authenticated user's assigned realm. However, due to the flaw in logic or filtering enforcement, an attacker can inject a query string that specifies a target realm different from their own. The system processes this request without adequately verifying whether the requesting administrator has permission to access data outside their designated administrative domain. This lack of strict boundary checking enables the retrieval of sensitive session information across tenant boundaries.
The operational impact of this vulnerability is significant for organizations relying on OpenAM for centralized identity management, particularly those operating in multi-tenant environments or using role-based delegation extensively. An attacker exploiting this flaw can enumerate usernames, universal IDs, and active session handles from all realms managed by the instance. This disclosure facilitates further attacks such as session hijacking, where an adversary takes over valid user sessions to impersonate legitimate users without needing credentials. It also aids in reconnaissance efforts, allowing attackers to map out the identity infrastructure, identify high-privilege accounts, and plan targeted phishing or lateral movement campaigns within the network.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Management, as it involves an actor obtaining privileges they are not authorized to have. It also relates to CWE-862, Missing Authorization, because the system fails to enforce access control policies on sensitive resources. In terms of offensive security frameworks like MITRE ATT&CK, this behavior corresponds to techniques involving Account Manipulation and Collection, specifically leveraging valid credentials to gather information about other accounts within a trusted environment. The ability to list sessions across realms supports lateral movement and persistence strategies by providing the attacker with actionable intelligence about active user connections.
Mitigation for this issue requires immediate patching of OpenAM to version 16.1.3 or later, where the authorization logic has been corrected to strictly enforce realm boundaries on session queries. Administrators should also review their delegation policies to ensure that RealmAdmin privileges are granted with the principle of least privilege in mind. Implementing additional monitoring for unusual API call patterns, particularly those involving cross-realm data access attempts, can help detect exploitation activities before significant damage occurs. Furthermore, organizations should consider implementing network-level segmentation or WAF rules to restrict direct exposure of administrative endpoints where possible, adding a layer of defense-in-depth against such logic-based vulnerabilities.