CVE-2026-45048

Name of the Vulnerable Software and Affected Versions Open Access Management (OpenAM) versions prior to 16.1.1

Description An insufficient authorization and information exposure issue exists in the session management endpoint. In deployments using stateful session storage, the SessionRequestHandler function does not enforce ownership or privilege checks when a low-privileged authenticated user queries session information. An attacker who possesses a target identity identifier can retrieve active session credentials of another user, including those of highly privileged accounts, allowing for session hijacking and potential administrative actions within the platform.

Recommendations Update to version 16.1.1.