Description

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session management endpoint does not enforce ownership or privilege checks when a low-privileged authenticated user queries session information in deployments using stateful session storage. A requester who knows a target identity identifier can retrieve another user's active session credentials, including credentials for a more privileged account, and use them to hijack that session. This issue is fixed in version 16.1.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-09-15T10:17:03.993Z",
  "pubdate": "2026-09-15T10:17:03.993Z",
  "executiveSummary": "This vulnerability is an improper access control flaw within the Open Access Management (OpenAM) platform, specifically located in the session management endpoint. The issue affects all versions of OpenAM prior to 16.1.1 that utilize stateful session storage.\nThe vulnerability allows an authenticated low-privileged user to query and retrieve sensitive session credentials belonging to other users, including those with elevated administrative or higher-level privileges. By successfully querying the system for a target identity identifier, an attacker can obtain active session tokens and subsequently hijack authenticated sessions.\nThe risk implication is critical, as it facilitates unauthorized access to sensitive application data and administrative functions through session hijacking. Exploitation requires the attacker to be an authenticated user within the system, but does not require additional complex privileges. This flaw represents a significant risk to the confidentiality and integrity of session-managed user accounts within the environment.",
  "technicalDetails": "The vulnerability resides within the SessionRequestHandler component of the OpenAM session management endpoint. The root cause is a failure to implement mandatory ownership or privilege-level validation when processing session information requests in configurations utilizing stateful session storage. The application fails to verify whether the authenticated requester has the requisite authorization to view the session details associated with the provided identity identifier.\nIn a standard stateful session storage deployment, the system maintains session objects in a server-side repository. When a user sends a query to the session management endpoint, the SessionRequestHandler is responsible for retrieving the requested session metadata. Due to the lack of access control checks, the handler processes requests for any valid identity identifier provided by the user, regardless of whether the requester owns that session or possesses administrative oversight.\nThe attack flow proceeds as follows: 1. The attacker authenticates to the OpenAM instance as a standard, low-privileged user. 2. The attacker identifies or determines the target identity identifier (e.g., username or internal UID) for a victim account. 3. The attacker submits a request to the session management endpoint, supplying the target identity identifier within the request parameters. 4. The SessionRequestHandler processes the request without validating if the requester owns the target session. 5. The system returns the session credentials associated with the target identifier to the attacker. 6. The attacker extracts these credentials and uses them to spoof the victim's session, effectively hijacking the user's authenticated context.\nThe impact of this vulnerability is total session compromise. By obtaining valid session credentials, the attacker can masquerade as the target user, bypass secondary authentication protections associated with the session, and perform actions with the victim's permissions. Because this occurs at the session layer, the hijacked session remains active until the expiration time or explicit termination, allowing persistent unauthorized access to the victim's environment."
}