CVE-2026-45048
CVE-2026-45048 · OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC
Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session management endpoint does not enforce ownership or privilege checks when a low-privileged authenticated user queries session information in deployments using stateful session storage. A requester who knows a target identity identifier can retrieve another user's active session credentials, including credentials for a more privileged account, and use them to hijack that session. This issue is fixed in version 16.1.1.
CVSS 8.5 · Высокий · EPSS 0,4%
- Опубликовано
- Обновлено
Стек: system