Executive brief
Sesame Time, a human resources and time-tracking platform, was found to have a flaw in how it manages user sessions. An attacker who obtains a session identifier can impersonate a legitimate user to access sensitive corporate data, including emails and employee roles. This risk was increased because the system failed to properly expire old sessions, leaving multiple entry points open for potential misuse.
Technical details
A Broken Object Level Authorization (BOLA) / Insecure Direct Object Reference (IDOR) vulnerability exists in Sesame Time's session management (CWE-639). The application and its REST v3 API (specifically endpoints like /api/v3/security/me) rely solely on the session identifier (USID) for validation without verifying if the USID belongs to the requesting user. Furthermore, the application fails to revoke old USIDs upon new logins, leading to session accumulation. An attacker who intercepts or guesses a valid USID can perform unauthorized actions and data retrieval. The vendor has released a patch that strengthens server-side authorization checks.
Affected products
- Sesame Sesame Time All versions prior to the July 2026 fix
Timeline
- 2026-07-14: advisory: Coordinated publication by INCIBE-CERT
- 2026-07-14: patched: Fixed in the latest available version at time of disclosure