CVE-2026-45048

OpenAM (Open Access Management) versions prior to 16.1.1 fail to enforce ownership or privilege checks in the SessionRequestHandler of the session management endpoint when deployments use stateful session storage. A low-privileged authenticated attacker who knows (or can guess) a target user's identity identifier can query that user's session information and retrieve their active session credentials, including credentials belonging to more privileged accounts such as administrators. Those stolen credentials can then be reused to fully hijack the victim's session, accounting for the high CVSS 3.1 score of 8.5 (high impact to confidentiality, integrity, and availability across security scopes). Any organization self-hosting OpenAM with stateful sessions enabled and running a version older than 16.1.1 is affected. The flaw is patched in 16.1.1, and no public proof-of-concept or exploitation in the wild is currently known.

What to do: Upgrade to OpenAM 16.1.1 as soon as possible. If immediate patching is not feasible, restrict network access to the session management REST endpoint to trusted administrators only, and consider moving to stateless (client-based) sessions where the vulnerable server-side session query path does not apply. After patching, review session endpoint logs for authenticated low-privilege users querying identifiers other than their own, and invalidate existing sessions to retire any credentials that may have been exposed.