CVE-2026-105120: OpenAM authorization bypass in sessions REST endpoint

CVE-2026-105120 · Severity: medium · CVSS 4.9 · Published 2026-10-03

OpenAM is an identity and access management platform that manages user authentication and authorization across organizations. A flaw in its session query API allows realm administrators with delegated privileges to view user sessions and credentials across all organizational boundaries, exposing usernames, session identifiers, and session metadata of other tenants and administrators. This could lead to targeted attacks on high-privilege accounts and user enumeration.

Technologies: Open Identity Platform OpenAM. Vendors: Open Identity Platform.

Quick answers

Is CVE-2026-105120 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-105120 being exploited in the wild.
How severe is CVE-2026-105120?
Medium severity, with a CVSS score of 4.9, published 3 October 2026.
Which products and versions are affected?
Open Identity Platform OpenAM before 16.1.3; Open Identity Platform OpenAM Core REST before 16.1.3.
Is there a fix for CVE-2026-105120?
Yes: fixed in OpenAM 16.1.3. Until then: Restrict the session query endpoint at the reverse proxy or firewall to allow GET requests to /json/.../sessions with _queryFilter parameters only from administrative networks. Review all delegated administrator accounts holding RealmAdmin or REST read privileges on sessions and remove unnecessary privileges until the fix is deployed.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-09-18" }, { "kind": "advisory", "at": "2026-10-03" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105120 attacked?
It is attacked over the network.
Am I affected by CVE-2026-105120?
Check whether you run Open Identity Platform OpenAM or Open Identity Platform OpenAM Core REST at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: OpenAM 16.1.3

Restrict the session query endpoint at the reverse proxy or firewall to allow GET requests to /json/.../sessions with _queryFilter parameters only from administrative networks. Review all delegated administrator accounts holding RealmAdmin or REST read privileges on sessions and remove unnecessary privileges until the fix is deployed.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-09-18" }, { "kind": "advisory", "at": "2026-10-03" } ]

Technical details

The sessions REST endpoint (GET /json/{realm}/sessions?_queryFilter=...) fails to validate that the queried realm is within the caller's authorized scope. An authenticated administrator with RealmAdmin privileges can supply a _queryFilter parameter naming any other realm to enumerate sessions across tenant boundaries. The vulnerability discloses usernames, universal IDs, session handles, and session timing data; session tokens are not exposed and sessions cannot be hijacked.

Affected products

  • Open Identity Platform OpenAM before 16.1.3
  • Open Identity Platform OpenAM Core REST before 16.1.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.