Skip to content
Fencer Vulns
low 3.5

CVE-2026-79300 json

SEP sesam before 5.2.0.24 mishandles User Authorization with MFA.

published 2026-09-12 57 d ago modified 2026-09-22 47 d ago also EUVD-2026-76915

cvss
3.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 17%
public exploits
0
none known

Summary

SEP sesam before 5.2.0.24 mishandles User Authorization with MFA. If AD authentication is configured and MFA is enforced, an attacker can create a second OTP access capability. SEP sesam and Active Directory handle username capitalization differently, which may allow multiple SEP sesam user accounts to be created for the same Active Directory (AD) account. Active Directory treats usernames as case-insensitive, while SEP sesam distinguishes between different letter casing. As a result, the same AD user can be represented by multiple SEP sesam user accounts that differ only in username capitalization. When Active Directory authentication is configured and multi-factor authentication (MFA) is enforced, this behavior may allow an additional OTP Authenticator to be registered for the same AD account, reducing the effectiveness of MFA protection.

Patch / fix

  • SEP sesam 5.2.0.24

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
55 d ago

Exploit prediction

0.26% chance of exploitation in the next 30 days, higher than 17% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 3.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

Affected products

  • SEP sesam

Classification

Weakness
  • CWE-180 Incorrect Behavior Order: Validate Before Canonicalize

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.