TI-2026-32899 Aliases CVE-2026-45048 GHSA-vvhj-w2jq-263q

OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC

LOW 39CWE-200Published 2026-09-15 · Updated 2026-09-17

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: Information disclosure, Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-285.

Summary

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session management endpoint does not enforce ownership or privilege checks when a low-privileged authenticated user queries session information in deployments using stateful session storage. A requester who knows a target identity identifier can retrieve another user's active session credentials, including credentials for a more privileged account, and use them to hijack that session. This issue is fixed in version 16.1.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00428 37th percentileScored 2026-11-07

Fix Fixed OpenAM (OpenIdentityPlatform): 16.1.1org.openidentityplatform.openam:openam-core (Maven): 16.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenIdentityPlatform	OpenAM	before 16.1.1	16.1.1	Patch available	CNA
—	org.openidentityplatform.openam:openam-core (Maven)	before 16.1.1	16.1.1	Patch available	GHSA-vvhj-w2jq-263q

OpenAM VendorOpenIdentityPlatform Affected before 16.1.1 Fixed in 16.1.1 Patch available CNA
org.openidentityplatform.openam:openam-core (Maven) Vendor— Affected before 16.1.1 Fixed in 16.1.1 Patch available GHSA-vvhj-w2jq-263q

Remediation

Fix · CNA OpenAM (OpenIdentityPlatform) Fixed in 16.1.1
Fix · GHSA-vvhj-w2jq-263q org.openidentityplatform.openam:openam-core (Maven) Fixed in 16.1.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-45048
2026-10-03 Alias added: GHSA-vvhj-w2jq-263q
2026-10-28 3 new references · GHSA-vvhj-w2jq-263q

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-45048

Other 4

TI-2025-20332 OpenDJ Denial of Service (Dos) using alias loop CVSS 4.0HIGH 8.7
TI-2026-25836 Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM CVSS 4.0CRITICAL 9.3
TI-2026-86693 Session token disclosure in OpenAM notification WebSocket CVSS 4.0CRITICAL 10.0
TI-2026-86692 Authentication bypass in OpenAM SAML login accepts unsigned assertions CVSS 4.0CRITICAL 9.3
TI-2026-86691 Privilege escalation in OpenAM via self-registration attribute bypass CVSS 4.0CRITICAL 9.3
TI-2026-86685 Unbounded Java deserialization in OpenAM enables denial of service CVSS 4.0HIGH 8.7

See all 54 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences