CVE-2026-105120 OpenIdentityPlatform CVE debrief

Who should care

Realm administrators, security teams, and OpenAM users should assess exposure and prioritize verification of OpenAM versions and configurations. They should also review compensating controls and monitor for suspicious activity to minimize potential impact. Security teams should verify OpenAM deployments in their environments and assign owners for follow-up.

Why it matters

CVE-2026-105120 is an authorization bypass vulnerability in OpenAM before 16.1.3 that allows realm administrators to disclose sessions across realms, potentially leading to unauthorized access or disclosure of sensitive information.

• Potential disclosure of sensitive information across tenant boundaries
• Possible unauthorized access to session handles and universal IDs
• Need for verification of OpenAM versions and configurations
• Potential for lateral movement or privilege escalation

Technical summary

The vulnerability allows realm administrators to list sessions of every realm by supplying a _queryFilter naming another realm, potentially disclosing usernames, universal IDs, and session handles across tenant boundaries. This authorization bypass vulnerability in OpenAM before 16.1.3 can lead to unauthorized access or disclosure of sensitive information. The sessions REST endpoint query operation is affected, allowing attackers with delegated RealmAdmin privileges to disclose information across tenant boundaries.

Defensive priority

Realm administrators and security teams should assess exposure and prioritize verification of OpenAM versions and configurations.

Recommended defensive actions

• Verify OpenAM version and configuration to determine exposure
• Restrict RealmAdmin privileges to minimize potential impact
• Monitor for suspicious activity on the sessions REST endpoint
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the authorization bypass vulnerability in OpenAM before 16.1.3. The vulnerability allows realm administrators to list sessions of every realm by supplying a _queryFilter naming another realm, potentially disclosing usernames, universal IDs, and session handles across tenant boundaries. Evidence is limited to CVE and NVD entries, so defenders should verify OpenAM versions and configurations within their environments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.