CVE-2026-15389: Sesame Time Auth Bypass Vulnerability

CVE-2026-15389 Overview

CVE-2026-15389 is a broken access control vulnerability affecting the Sesame Time web application and its REST v3 API. The flaw resides in the session management layer, where the application relies solely on the session identifier (USID) to validate requests. The server does not verify that the presented USID belongs to the user making the request. An attacker who obtains a valid USID can impersonate the victim and read confidential data including emails, user IDs, roles, and corporate information. The issue is compounded by poor session lifecycle handling: new logins issue additional USIDs without invalidating prior sessions.

Critical Impact
A stolen or leaked session identifier grants full read access to the victim's account data through the REST v3 API, with no additional authorization checks enforced server-side.

Affected Products

Sesame Time web application
Sesame Time REST v3 API
Sesame Time session management component

Discovery Timeline

2026-07-14 - CVE-2026-15389 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-15389

Vulnerability Analysis

The vulnerability is classified under [CWE-639] Authorization Bypass Through User-Controlled Key. Sesame Time treats the USID session token as sufficient proof of identity for API requests. The REST v3 API does not cross-reference the USID against the authenticated principal or the resource owner. This design permits horizontal privilege escalation whenever an attacker can capture or replay a valid USID belonging to another user.

Requests carrying a stolen USID return the victim's mailbox contents, assigned roles, and organizational metadata. Because the identifier is the only trust anchor, the API cannot distinguish a legitimate user from an attacker replaying the token.

Root Cause

The root cause is missing object-level authorization in the API. The server accepts a USID and returns records associated with that session context, without validating whether the calling principal is authorized to access the referenced user or resource. In addition, the session store permits unbounded coexistence of active USIDs per account. New logins create additional identifiers without revoking previous ones, extending the window during which stolen tokens remain valid.

Attack Vector

Exploitation occurs over the network with no privileges or user interaction required. An attacker who acquires a USID through network interception, log exposure, cross-site scripting, or a malicious integration can issue authenticated calls to the REST v3 API. Each call returns data belonging to the session's original owner. Because prior sessions are never invalidated, tokens harvested from earlier browser instances or cached artifacts remain usable until the server-side entry expires.

The vulnerability manifests in the session validation logic of the REST v3 API. See the INCIBE Notice on Access Control for the coordinated disclosure details.

Detection Methods for CVE-2026-15389

Indicators of Compromise

Multiple concurrent active USIDs bound to the same user account across different source IP addresses or geographic regions.
REST v3 API requests where the source IP or User-Agent differs from the client that originally authenticated the session.
Unusual volumes of read requests to user profile, mailbox, or role endpoints from a single USID within a short interval.

Detection Strategies

Correlate authentication events with subsequent API calls and flag mismatches between the login IP and the requesting IP for the same USID.
Baseline normal session counts per user and alert on accounts that exceed the expected number of simultaneous active sessions.
Inspect API access logs for repeated enumeration patterns targeting /api/v3/ endpoints tied to sensitive resources.

Monitoring Recommendations

Log every USID issuance, use, and expiration event with source IP, User-Agent, and timestamp for retrospective analysis.
Forward Sesame Time application and API logs to a centralized analytics platform to enable cross-session correlation.
Alert on privileged role reads or bulk data retrieval originating from sessions with anomalous lifetime or reuse patterns.

How to Mitigate CVE-2026-15389

Immediate Actions Required

Contact the Sesame Time vendor for a fixed release and confirm patch availability before continued production use.
Force-invalidate all existing USIDs and require users to re-authenticate to shrink the pool of potentially compromised tokens.
Restrict network exposure of the REST v3 API to trusted networks or through an authenticating gateway while a fix is pending.

Patch Information

No vendor patch reference is published in the NVD entry at the time of writing. Refer to the INCIBE Notice on Access Control for the latest vendor coordination status and apply updates as soon as they are released.

Workarounds

Enforce short session lifetimes and idle timeouts at the reverse proxy or API gateway to reduce token reuse windows.
Bind sessions to client attributes such as source IP or device fingerprint at the gateway layer and reject mismatched requests.
Revoke previous USIDs automatically on every new authentication event to prevent concurrent session accumulation.

bash

# Example: nginx rule to reject REST v3 API calls that lack a matching origin binding
location /api/v3/ {
    if ($http_x_forwarded_for != $cookie_client_bind) {
        return 403;
    }
    proxy_pass http://sesame_backend;
}