CVE-2026-45048 json
OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC
published 2026-06-23 4 mo ago modified 2026-10-28 11 d ago also EUVD-2026-78357 , GHSA-vvhj-w2jq-263q
- cvss
- 8.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 37%
- public exploits
- 0
- none known
Summary
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session management endpoint does not enforce ownership or privilege checks when a low-privileged authenticated user queries session information in deployments using stateful session storage. A requester who knows a target identity identifier can retrieve another user's active session credentials, including credentials for a more privileged account, and use them to hijack that session. This issue is fixed in version 16.1.1.
Patch / fix
- maven org.openidentityplatform.openam:openam-core 16.1.1
- openidentityplatform openam 16.1.1
- org.openidentityplatform.openam openam-core 16.1.1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 53 d ago
Exploit prediction
0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 8.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.openidentityplatform.openam:openam-core | <16.1.1 |
16.1.1 |
Affected products
- OpenIdentityPlatform OpenAM
Classification
References
-
github.com
/OpenIdentityPlatform/OpenAM/commit/f775b42236b3cb94e3a02a19f4a4f4f5cc0b91c4
web
-
github.com
/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-vvhj-w2jq-263q
web
-
github.com
/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-45048
advisory
-
github.com
/OpenIdentityPlatform/OpenAM
package
Sources
- CVE List CVE-2026-45048
- GitHub Advisory GHSA-vvhj-w2jq-263q
- NVD CVE-2026-45048
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.