CVE-2026-45048

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session management endpoint does not enforce ownership or privilege checks when a low-privileged authenticated user queries session information in deployments using stateful session storage. A requester who knows a target identity identifier can retrieve another user's active session credentials, including credentials for a more privileged account, and use them to hijack that session. This issue is fixed in version 16.1.1.

• CWE-200
• CWE-285

• https://github.com/OpenIdentityPlatform/OpenAM/commit/f775b42236b3cb94e3a02a19f4a4f4f5cc0b91c4
• https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1
• https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-vvhj-w2jq-263q

Published

Sep 15, 2026

Last Modified

Sep 23, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45042RustFS is a distributed object storage system built in Rust.…7.1
• CVE-2026-45043RustFS is a distributed object storage system built in Rust.…9.3
• CVE-2026-45044RustFS is a distributed object storage system built in Rust.…8.8
• CVE-2026-45045Fiber is an Express inspired web framework written in Go. Pr…5.3
• CVE-2026-45046Gryph provides a security layer for AI coding agents. Prior …5.5
• CVE-2026-45047bird-lg-go is a BIRD looking glass in Go. Prior to 1.4.5, th…7.5
• CVE-2026-4505A vulnerability has been found in eosphoros-ai DB-GPT up to …6.3
• CVE-2026-45051Open Access Management (OpenAM) is an access management solu…9.2
• CVE-2026-45052Open Access Management (OpenAM) is an access management solu…9.3
• CVE-2026-45053CubeCart is an ecommerce software solution. Prior to 6.7.0, …9.1
• CVE-2026-45054CubeCart is an ecommerce software solution. Prior to 6.7.0, …4.9
• CVE-2026-45055CubeCart is an ecommerce software solution. Prior to 6.7.2, …8.1