OpenAM EUVD-2026-92024

Exploitation requires an authenticated account holding delegated RealmAdmin privileges and a multi-realm (multi-tenant) OpenAM deployment on a version before 16.1.3; the attacker invokes the sessions REST endpoint query operation and supplies a _queryFilter that names a realm other than their own to read that realm's session data. Limiting factors that reduce real-world risk: the attacker must already be a provisioned realm administrator (PR:H, not anonymous), the instance must host more than one realm for cross-tenant disclosure to be meaningful, and single-realm/single-tenant deployments are effectively unaffected. No end-user interaction is required (UI:N), and impact is confined to confidentiality (session identifiers and account identifiers), not modification or disruption.

This is a medium-severity information-disclosure flaw (CVE-2026-105120, CWE-200) whose real-world priority is bounded primarily by its privilege requirement. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N) correctly reflects a network-reachable, low-complexity attack with high confidentiality impact but NO integrity or availability impact, and critically PR:H - the attacker must already hold delegated RealmAdmin privileges. This is therefore an insider/trust-boundary problem (a semi-trusted realm administrator escalating visibility across tenant boundaries) rather than an anonymous internet attack. No EPSS score, no CISA KEV listing, and no public exploit code were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. No SSVC decision data was supplied. The signals are internally consistent - the description's 'realm administrators'/'delegated RealmAdmin privileges' language matches the vector's PR:H, so there is no network-vs-local or privilege conflict to flag. Bottom line: a legitimate, verifiable authorization-bypass bug that matters acutely for multi-tenant OpenAM operators but is not a drop-everything, mass-exploitation threat given the required privileged foothold and confidentiality-only impact.

A managed-service or hosting provider runs a single OpenAM instance serving multiple customer realms, and delegates RealmAdmin rights to each tenant for self-service. A malicious or compromised tenant administrator sends a crafted query to the sessions REST endpoint with a _queryFilter referencing a different realm, and receives back usernames, universal IDs, and active session handles belonging to other tenants. No public exploit code is referenced, but the attack requires only a standard authenticated REST call (AV:N/AC:L), so it is trivial to reproduce once the privileged account exists.