CVE-2026-79300
Summary
by MITRE • 09/13/2026
SEP sesam before 5.2.0.24 mishandles User Authorization with MFA. If AD authentication is configured and MFA is enforced, an attacker can create a second OTP access capability. SEP sesam and Active Directory handle username capitalization differently, which may allow multiple SEP sesam user accounts to be created for the same Active Directory (AD) account. Active Directory treats usernames as case-insensitive, while SEP sesam distinguishes between different letter casing. As a result, the same AD user can be represented by multiple SEP sesam user accounts that differ only in username capitalization. When Active Directory authentication is configured and multi-factor authentication (MFA) is enforced, this behavior may allow an additional OTP Authenticator to be registered for the same AD account, reducing the effectiveness of MFA protection.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/13/2026
The vulnerability identified in SEP sesam versions prior to 5.2.0.24 represents a critical flaw in user authorization and identity management logic, specifically concerning the integration with Active Directory environments that enforce Multi-Factor Authentication. This issue stems from a fundamental discrepancy in how the application handles character case sensitivity compared to its underlying directory service provider. While Active Directory treats usernames as inherently case-insensitive entities for authentication purposes, SEP sesam implements strict case-sensitive string matching for user account identification and creation within its local database schema. This architectural mismatch creates an opportunity for identity ambiguity where a single logical user in the enterprise directory can manifest as multiple distinct accounts within the application layer solely based on variations in username capitalization during registration or synchronization processes.
From a technical perspective, this flaw allows an attacker who possesses valid credentials for a specific Active Directory account to exploit the case-sensitivity difference to register additional OTP authenticators against that same identity. When MFA is enforced, the security model relies on the assumption that each user has exactly one registered second factor device or method. However, because SEP sesam does not normalize usernames before checking for existing accounts or binding them to a single authentication profile, an attacker can create new application-level entries using different capitalizations of their username, such as User1 versus USER1. Each of these distinct entries is treated by the system as a separate user entity eligible for independent MFA registration. Consequently, this enables the provisioning of multiple OTP tokens or authenticator apps linked to what should be considered a single identity in the broader security context.
The operational impact of this vulnerability significantly undermines the integrity and effectiveness of Multi-Factor Authentication controls. By allowing multiple OTP access capabilities per AD account, the system fails to enforce the principle that MFA provides assurance through unique possession factors tied to one user profile. An attacker who has compromised a password but is blocked by an existing OTP token can bypass this control simply by registering a new authenticator under a case-varied username alias. This effectively neutralizes the additional security layer provided by MFA, as the authentication process may accept credentials from any of the registered OTP methods associated with the various capitalization variants of that user account. This scenario facilitates unauthorized access and increases the attack surface for credential-based attacks within environments relying on SEP sesam for backup management operations.
This vulnerability aligns closely with CWE-287, which describes Improper Authentication, specifically regarding the failure to uniquely identify users during authentication processes. It also relates to CWE-613, Insufficient Session Expiration, insofar as it allows persistent unauthorized access through multiple valid session tokens derived from different authenticator registrations. In terms of MITRE ATT&CK framework mapping, this behavior facilitates Account Manipulation techniques where an adversary modifies existing accounts or creates new ones to maintain persistence and bypass security controls. The specific mechanism leverages the lack of input normalization for identity attributes, which is a common pitfall in systems integrating with external directory services that have different case-sensitivity rules than the application itself.
To mitigate this vulnerability, organizations running SEP sesam versions prior to 5.2.0.24 must apply the vendor-provided patch immediately upon availability. The fix involves implementing strict username normalization logic within the user authorization module to ensure that all incoming usernames are converted to a consistent case format before being checked against existing records or used for account creation. This ensures that Active Directory accounts map one-to-one with SEP sesam user profiles regardless of how the username is capitalized during login attempts or registration requests. Until the patch is applied, administrators should monitor logs for unusual patterns in MFA registrations and consider restricting direct AD integration to only trusted administrative users while evaluating alternative access controls such as IP whitelisting or network segmentation to limit exposure to this specific authentication bypass vector.