What is the CVSS score of CVE-2026-45048?

CVE-2026-45048 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of OpenAM are affected by CVE-2026-45048?

OpenAM Community Edition through version 16.0.6 contains a privilege escalation vulnerability (CVE-2026-45048, CVSS 8.5) that allows low-privileged users to steal session tokens from arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-45048?

Within 24 hours: Inventory all systems running OpenAM Community Edition versions ≤16.0.6 and identify assets with administrative accounts. Within 7 days: Restrict network access to the session management RPC endpoint to essential trusted networks only via firewall rules; isolate non-critical OpenAM instances. Within 30 days: Develop a migration strategy to replace OpenAM Community Edition, as no vendor patch is available-evaluate OpenAM Enterprise or alternative identity management platforms.

OpenAM CVE-2026-45048

EUVD-2026-78357 HIGH

Information Exposure (CWE-200)

2026-06-23 https://github.com/OpenIdentityPlatform/OpenAM

GHSA-vvhj-w2jq-263q

Information Disclosure

8.5

CVSS 3.1 · Vendor: https://github.com/OpenIdentityPlatform/OpenAM

Severity by source

Vendor (https://github.com/OpenIdentityPlatform/OpenAM) PRIMARY

8.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.5 HIGH

Network-reachable RPC requires low-priv auth (PR:L) and knowledge of target identifier (AC:H); stealing an admin token crosses an authorization boundary (S:C) and fully compromises the victim account (C/I/A:H).

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (https://github.com/OpenIdentityPlatform/OpenAM).

CVSS VectorVendor: https://github.com/OpenIdentityPlatform/OpenAM

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 23, 2026 - 18:30 vuln.today

Analysis Generated

Jun 23, 2026 - 18:30 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

55 maven packages depend on org.openidentityplatform.openam:openam-core (51 direct, 4 indirect)

Ecosystem-wide dependent count for version 16.1.1.

DescriptionCVE.org

Summary

Description

An insufficient authorization (CWE-285) and information exposure (CWE-200) issue in OpenAM's session management endpoint allows a low-privileged authenticated user to retrieve active session credentials belonging to other users, including those with higher privileges. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1.

This may be related to CVE-2021-4201, a similar issue patched in ForgeRock Access Management, a separate product sharing a common codebase ancestry.

Impact

OpenAM Community Edition deployments through version 16.0.6 using stateful session storage and exposing the session management endpoint are potentially affected. The endpoint does not enforce ownership or privilege checks when querying session information, meaning an authenticated user may retrieve active session credentials for arbitrary users. Successful exploitation requires a valid low-privilege session and knowledge of a target user's identity identifier, which may be obtainable through normal platform functionality.

If credentials belonging to a highly privileged account are obtained, this could enable further administrative actions within the platform

Patch

This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.

AnalysisAI

Authenticated privilege escalation in OpenAM Community Edition through 16.0.6 allows a low-privileged user to retrieve raw session tokens belonging to arbitrary other users via the session management RPC endpoint, which fails to enforce ownership or privilege checks. Capturing an administrator's session token enables full account takeover of higher-privileged accounts. No public exploit identified at time of analysis, but a GitHub Security Advisory (GHSA-vvhj-w2jq-263q) has been published by the Open Identity Platform maintainers.

Technical ContextAI

OpenAM Community Edition is the open-source identity and access management platform maintained by the Open Identity Platform community, forked from the original ForgeRock/Sun OpenAM codebase. The affected component is the openam-core Maven artifact (pkg:maven/org.openidentityplatform.openam:openam-core), specifically the session management endpoint that exposes session lookup over an RPC-style interface against stateful (server-side) session storage. The root cause maps to CWE-285 (Improper Authorization) combined with CWE-200 (Exposure of Sensitive Information): the endpoint accepts a target session/user identifier and returns the live session credential without verifying that the caller owns the session or holds an administrative role. Because session tokens in OpenAM are bearer credentials, disclosure equals impersonation. The advisory notes lineage with CVE-2021-4201 in ForgeRock Access Management, indicating a shared-ancestor authorization flaw that was previously patched downstream but persisted in the community fork.

RemediationAI

Upgrade to OpenAM Community Edition 16.1.1 or later, which contains the authorization fix per the GHSA-vvhj-w2jq-263q advisory; the Maven coordinates are org.openidentityplatform.openam:openam-core version 16.1.1. For deployments that cannot patch immediately, restrict network access to the session management RPC endpoint at the reverse proxy or WAF so that only administrative IP ranges can reach it (trade-off: breaks legitimate user-initiated session queries from arbitrary clients), and consider switching from stateful to client-side (stateless/JWT) sessions where the deployment allows it (trade-off: changes session revocation semantics and may require application changes). Tighten user-provisioning workflows to prevent untrusted self-registration of low-privilege accounts, since the vulnerability requires only a valid low-privilege session to weaponize. Rotate any administrative session tokens and force re-authentication of privileged accounts after patching, in case prior disclosure occurred undetected.