CVE-2026-105120 Overview
CVE-2026-105120 is an authorization bypass vulnerability in OpenAM versions before 16.1.3. The flaw resides in the sessions REST endpoint query operation. Realm administrators can enumerate active sessions across every realm, not just their assigned realm.
Attackers holding delegated RealmAdmin privileges can submit a _queryFilter referencing another realm. The server returns usernames, universal IDs, and session handles belonging to tenants outside the attacker's authority. This breaks the multi-tenant isolation model that OpenAM realms are designed to enforce. The weakness is tracked as [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].
Critical Impact
Delegated realm administrators can disclose session identifiers and user identities across tenant boundaries, enabling reconnaissance and potential session abuse against unrelated realms.
Affected Products
- OpenIdentityPlatform OpenAM versions prior to 16.1.3
- Deployments relying on realm-based multi-tenancy for isolation
- Any OpenAM instance exposing the sessions REST endpoint to delegated administrators
Discovery Timeline
- 2026-10-03 - CVE-2026-105120 published to NVD
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-105120
Vulnerability Analysis
OpenAM implements realms as isolated administrative boundaries. Each realm has its own users, policies, and session store. The RealmAdmin role is intended to grant administrative control over a single realm only.
The sessions REST endpoint accepts a _queryFilter parameter to retrieve active session metadata. The query handler fails to verify that the realm named in the filter matches the caller's authorized realm scope. As a result, the endpoint returns session records from any realm the attacker chooses to reference.
Returned data includes usernames, universal IDs, and session handles. Session handles are particularly sensitive because they identify live authenticated sessions. An attacker can combine this disclosure with other weaknesses to map tenant populations, identify high-value accounts, and support follow-on attacks against unrelated realms.
Root Cause
The sessions query operation performs authentication and confirms the caller holds RealmAdmin privileges. It does not perform a scope check that constrains the query to the caller's own realm. Authorization is treated as a binary role check instead of a per-realm access decision. This is a missing authorization check tied to tenant context, consistent with [CWE-200].
Attack Vector
Exploitation requires network access to the OpenAM administrative REST interface and valid delegated RealmAdmin credentials in any realm. The attacker issues an authenticated REST query to the sessions endpoint. The _queryFilter parameter is crafted to name a different realm. The response contains session metadata from that target realm.
No user interaction is required. The vulnerability can be exploited repeatedly to enumerate sessions across all realms configured in the deployment. For technical specifics, see the GitHub Security Advisory GHSA-x8cj-3hqv-cgwh and the VulnCheck Advisory on OpenAM Session Disclosure.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-105120
Indicators of Compromise
- REST requests to the sessions endpoint containing _queryFilter values that reference a realm different from the authenticated caller's realm.
- Unusual volume of session enumeration queries from a single delegated administrator account.
- Access log entries showing successful sessions queries returning records with universal IDs from multiple realms.
Detection Strategies
- Parse OpenAM access and audit logs for sessions endpoint requests and compare the realm in _queryFilter against the caller's assigned realm scope.
- Alert on any delegated RealmAdmin account issuing sessions queries outside its own realm.
- Baseline normal administrative query patterns per realm and flag deviations in query frequency or breadth.
Monitoring Recommendations
- Forward OpenAM audit logs to a centralized logging platform and retain them for correlation across administrative actions.
- Monitor for lateral discovery patterns where a single account enumerates sessions, users, or policies across multiple realms.
- Review delegated administrator role assignments on a recurring basis to confirm scope matches operational need.
How to Mitigate CVE-2026-105120
Immediate Actions Required
- Upgrade OpenAM to version 16.1.3 or later, which contains the authorization fix for the sessions query endpoint.
- Audit all accounts holding the RealmAdmin role and revoke access that is not operationally required.
- Rotate session secrets and invalidate active administrative sessions after patching to clear any previously disclosed handles.
Patch Information
The fix is delivered in OpenAM 16.1.3. The upstream project enforces realm scope checking on the sessions REST endpoint so that _queryFilter operations are constrained to the caller's authorized realm. Refer to the GitHub Security Advisory GHSA-x8cj-3hqv-cgwh for upgrade guidance.
Workarounds
- Restrict network access to the OpenAM administrative REST interface so that only trusted management hosts can reach the sessions endpoint.
- Remove delegated RealmAdmin privileges from accounts that do not require session management capabilities until the upgrade is complete.
- Deploy a reverse proxy or API gateway rule that rejects sessions queries whose _queryFilter references a realm the caller does not own.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
