CVE-2026-45048: OpenAM Session Hijacking Vulnerability

CVE-2026-45048 Overview

Open Identity Platform OpenAM contains a broken access control flaw in its session management endpoint. The SessionRequestHandler component fails to enforce ownership or privilege checks when a low-privileged authenticated user queries session information in deployments using stateful session storage. An attacker who knows a target identity identifier can retrieve another user's active session credentials, including credentials belonging to a more privileged account, and use them to hijack that session. The issue is fixed in OpenAM version 16.1.1 and tracked as [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
An authenticated low-privileged user can retrieve and hijack the active sessions of higher-privileged accounts, resulting in full account takeover across the OpenAM deployment.

Affected Products

Open Identity Platform OpenAM versions prior to 16.1.1
Deployments configured with stateful session storage
OpenAM instances exposing the session service RPC endpoint

Discovery Timeline

2026-09-15 - CVE-2026-45048 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-45048

Vulnerability Analysis

OpenAM's SessionRequestHandler processes session service RPC requests including GetValidSessions, GetSessionCount, GetSession, Logout, and AddSessionListener. Before the patch, the handler only verified that the requesting session was not a restricted token. It did not validate whether the requester owned the target session or held sufficient privilege to query it.

Because of this missing authorization check, any authenticated user could invoke GetSession against a known identity identifier and retrieve the corresponding session token. In stateful deployments, that token is a bearer credential; possession is sufficient to impersonate the target user. Exploitation requires network access to the session endpoint and a valid low-privilege account, but succeeds regardless of the victim's role.

Root Cause

The root cause is missing authorization enforcement in openam-core/src/main/java/com/iplanet/dpro/session/service/SessionRequestHandler.java. The switch branch that handled GetValidSessions and GetSessionCount performed only a restricted-token check and then fell through to shared processing logic. No ownership or privilege comparison was made between the requesting principal and the target session. The vulnerability is classified as broken access control leading to session hijacking.

Attack Vector

Exploitation proceeds over the network against the session service endpoint. The attacker authenticates with a low-privilege account, then issues a session RPC request targeting an administrator or other privileged identity. The response returns the target's active session credentials, which the attacker replays to assume that identity. The attack requires knowledge of the target identifier, but such identifiers are commonly discoverable through directory enumeration or predictable naming.

java

         switch (req.getMethodID()) {
             case SessionRequest.GetValidSessions:
             case SessionRequest.GetSessionCount:
-                verifyRequestingSessionIsNotRestrictedToken(requesterSession);
-                break;
-
+                //GHSA-vvhj-w2jq-263q: prevent getting session count,
+                //as the session quota used only by internal functionality
+                throw new SessionRequestException(requesterSession.getSessionID(), SessionBundle.getString("unknownRequestMethod"));
             case SessionRequest.GetSession:
             case SessionRequest.Logout:
             case SessionRequest.AddSessionListener:

Source: GitHub Commit f775b42. The patch removes the vulnerable code path entirely, rejecting GetValidSessions and GetSessionCount requests as unknown methods because the underlying session quota is used only by internal functionality.

Detection Methods for CVE-2026-45048

Indicators of Compromise

Session service RPC calls invoking GetSession, GetValidSessions, or GetSessionCount from low-privilege accounts against identifiers they do not own
Repeated session endpoint requests iterating across distinct identity identifiers in a short time window
Concurrent active sessions for a privileged account originating from unexpected source IP addresses or user agents
Authentication-free administrative actions immediately following a session query from a non-administrative account

Detection Strategies

Enable OpenAM audit logging for session service operations and correlate requesterSession identity with the target session owner
Alert on any session RPC method invocation where the requesting principal differs from the target identity and is not a service account
Baseline normal session query behavior per role and flag deviations, especially queries against administrative identifiers

Monitoring Recommendations

Forward OpenAM access, session, and audit logs to a centralized SIEM for correlation with downstream administrative actions
Monitor for privileged session reuse from multiple concurrent IP addresses, which indicates token replay
Track failed and successful invocations of session RPC endpoints and alert on volume spikes from a single authenticated identity

How to Mitigate CVE-2026-45048

Immediate Actions Required

Upgrade all OpenAM deployments to version 16.1.1 or later
Invalidate all active sessions after upgrade to revoke any tokens that may have been harvested prior to patching
Rotate credentials for administrative accounts and review recent administrative activity for unauthorized changes
Restrict network exposure of the OpenAM session service endpoint to trusted internal networks only

Patch Information

The fix is delivered in OpenAM Release 16.1.1. The corresponding source change is documented in GitHub Commit f775b42 and the vendor advisory GHSA-vvhj-w2jq-263q. The patch rejects GetValidSessions and GetSessionCount requests through the external RPC path, closing the authorization gap.

Workarounds

Where immediate upgrade is not feasible, restrict access to the session service endpoint using network-level ACLs or a reverse proxy
Migrate from stateful to client-based (stateless) session storage, which is not affected by this vulnerability
Reduce session lifetimes and enable session binding to source IP where operationally acceptable to limit the window for token replay

bash

# Verify the deployed OpenAM version and confirm 16.1.1 or later
curl -s https://openam.example.com/openam/json/serverinfo/* | jq '.version'

# Example reverse-proxy restriction limiting session RPC access to trusted subnets
location /openam/sessionservice {
    allow 10.0.0.0/8;
    deny  all;
    proxy_pass http://openam-backend;
}