CVE-2026-45048: Open Identity Platform OpenAM privilege escalation in session management endpoint

Executive brief

OpenAM, an open-source identity and access management solution, contains a security flaw in its session management component. A user with basic login access can exploit this to steal the active session credentials of other users, including administrators. If an attacker successfully hijacks an administrator's session, they could gain full control over the platform and its managed user data.

Technical details

An improper authorization (CWE-285) and information exposure (CWE-200) vulnerability exists in the OpenAM session management endpoint. The endpoint fails to enforce ownership or privilege checks when processing session queries, allowing any authenticated user to retrieve active session credentials for other users if they know the target's identity identifier. This issue specifically affects deployments using stateful session storage. Attackers can leverage this to escalate privileges by obtaining tokens for administrative accounts. The vulnerability is patched in version 16.1.1.

Affected products

• Open Identity Platform OpenAM Community Edition <= 16.0.6

Timeline

• 2026-06-23: advisory: GitHub Advisory published
• 2026-06-23: patched: Version 16.1.1 released

References

• https://api.github.com/users/wodzen
• https://github.com/wodzen
• https://api.github.com/users/wodzen/gists%7B/gist_id%7D
• https://api.github.com/users/wodzen/repos
• https://avatars.githubusercontent.com/u/25558174?v=4
• https://api.github.com/users/wodzen/events%7B/privacy%7D