Which versions of Sesame Time are affected by CVE-2026-15389?

The Sesame Time web application and REST v3 API contain a critical authorization flaw (CVE-2026-15389, CVSS 8.7) allowing attackers with any valid session identifier to impersonate other users and…

How to fix or mitigate CVE-2026-15389?

Within 24 hours: perform inventory of all active Sesame Time sessions and implement enhanced monitoring for anomalous cross-user session access patterns. Within 7 days: deploy session binding controls tying session identifiers to specific IP addresses and device fingerprints, implement mandatory session invalidation of all prior sessions upon new user login to address documented session sprawl, and restrict concurrent active sessions per user account. Within 30 days: establish formal logging and alerting for cross-user session access attempts, conduct security awareness training on session credential protection, and maintain readiness to apply vendor patch once available.

Sesame Time CVE-2026-15389

Q: What is the CVSS score of CVE-2026-15389?

CVE-2026-15389 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-43657 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-14 INCIBE

GHSA-98qr-jpxv-vfp8

Authentication Bypass Sesame Time

8.7

CVSS 4.0 · Vendor: INCIBE

Severity by source

Vendor (INCIBE) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable API, low complexity, and no privilege to the target account (USID acts as an unbound bearer key) give PR:N; impact is confidentiality-only, so I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (INCIBE).

CVSS VectorVendor: INCIBE

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 10:49 vuln.today

CVE Published

Jul 14, 2026 - 10:10 cve.org

HIGH 8.7

DescriptionCVE.org

A vulnerability relating to insufficient access control has been identified in the session management of the Sesame Time web application and its REST v3 API. The flaw lies in the fact that the system uses the session identifier (USID) as the sole validation mechanism, without verifying whether that identifier legitimately belongs to the user making the request. As a result, an attacker who obtains a valid USID can impersonate a victim’s session and access their confidential information, including emails, user IDs, roles and corporate data. This vulnerability is exacerbated by poor session lifecycle management: new logins generate additional USIDs without revoking the previous ones, allowing multiple active sessions to coexist and thereby expanding the attack surface.

AnalysisAI

Broken object-level authorization in the Sesame Time web application and its REST v3 API lets remote attackers hijack another user's session by presenting a valid session identifier (USID), because the platform treats the USID as a bearer credential and never verifies that it belongs to the requester. Any attacker who obtains a valid USID can read a victim's confidential data - emails, user IDs, roles and corporate information - and the weakness is compounded by session sprawl, since new logins mint additional USIDs without invalidating prior ones. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The affected component is Sesame Time, a cloud-based HR time-and-attendance/workforce-management platform, specifically its session management layer and REST v3 API. The root cause maps to CWE-639 (Authorization Bypass Through User-Controlled Key): the USID session token is used as the sole validation mechanism, functioning as an unbound bearer key that is not cross-checked against the identity of the account making the request. Because the API authorizes on token possession alone rather than on token-to-user binding, one user's valid USID can be used to fetch another user's resources. The stated CPE cpe:2.3:a:sesame_time:sesame_time:*:*:*:*:*:*:*:* indicates all versions of the application are in scope with no fixed boundary published. A secondary defect in session lifecycle management - failure to revoke previous USIDs on new authentication - permits many concurrent valid sessions per account, enlarging the pool of usable tokens and lengthening their exploitable lifetime.

RemediationAI

No vendor-released patch version was identified at time of analysis; consult the INCIBE-CERT advisory (https://www.incibe.es/en/incibe-cert/notices/aviso/inadequate-access-control-sesame-time-session-management) and the vendor for a fixed release, since this is a server-side SaaS flaw that must ultimately be corrected by the provider by binding each USID to its owning user and enforcing object-level authorization on every REST v3 API call. As compensating controls pending a vendor fix: enforce short session-token lifetimes and server-side session revocation on new login to eliminate the coexisting-USID condition (trade-off: users are logged out of older devices); ensure USIDs are transmitted and stored only over TLS and never in URLs, query strings, or logs to reduce token leakage (trade-off: requires client/integration review); restrict API exposure to trusted networks or via a gateway that enforces per-user authorization where feasible (trade-off: may break legitimate integrations); and rotate/invalidate existing sessions and monitor for anomalous cross-user access patterns. Because the fix depends on the SaaS backend, customers should also request confirmation from the vendor that the ownership-validation defect has been remediated.