CVE-2026-105120: OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint
OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to list sessions of every realm. Attackers holding delegated RealmAdmin privileges can supply a queryFilter naming another realm to disclose usernames, universal IDs, and session handles across tenant boundaries.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already hold delegated RealmAdmin privileges. The issue allows that administrator to cross tenant boundaries and list sessions belonging to other realms.
What information can be disclosed?
The affected sessions REST endpoint can disclose usernames, universal IDs, and session handles for sessions in every realm.
Which deployments are affected?
ForgeRock OpenAM versions before 16.1.3 are affected. The provided information does not identify any configuration prerequisite beyond access to the sessions REST endpoint and delegated RealmAdmin privileges.
How is the cross-realm disclosure triggered?
A delegated RealmAdmin can submit a sessions REST endpoint query using a _queryFilter that names another realm, bypassing the expected realm authorization boundary.