EUVD-2026-76915
GHSA-7gr9-32jg-84c9
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
Network-reachable but requires AD+MFA dual config (AC:H), low-privilege account to register users (PR:L), and scope change because MFA boundary extends beyond sesam.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
SEP sesam before 5.2.0.24 mishandles User Authorization with MFA. If AD authentication is configured and MFA is enforced, an attacker can create a second OTP access capability. SEP sesam and Active Directory handle username capitalization differently, which may allow multiple SEP sesam user accounts to be created for the same Active Directory (AD) account. Active Directory treats usernames as case-insensitive, while SEP sesam distinguishes between different letter casing. As a result, the same AD user can be represented by multiple SEP sesam user accounts that differ only in username capitalization. When Active Directory authentication is configured and multi-factor authentication (MFA) is enforced, this behavior may allow an additional OTP Authenticator to be registered for the same AD account, reducing the effectiveness of MFA protection.
AnalysisAI
MFA weakening in SEP sesam before 5.2.0.24 allows a low-privileged attacker to register a second OTP authenticator for the same Active Directory account by exploiting a case-sensitivity mismatch between SEP sesam (case-sensitive) and Active Directory (case-insensitive) username handling. When AD authentication and MFA enforcement are both configured, an attacker can create a duplicate SEP sesam account using a differently-cased variant of an existing AD username, then attach a separate OTP credential to that account - effectively establishing an additional authentication path that circumvents the intended MFA control. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two non-default configuration prerequisites to be simultaneously active: (1) Active Directory authentication must be configured as the identity provider for SEP sesam, and (2) MFA must be enforced within SEP sesam. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The overall risk is low-to-moderate in absolute terms but contextually significant wherever MFA is the primary security control. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade SEP sesam to version 5.2.0.24 or later per the vendor's Release Notes 5.2.0 Artemis advisory at https://wiki.sep.de/wiki/index.php/Release_Notes_5.2.0_Artemis#fixed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today