Sesam
Monthly
MFA weakening in SEP sesam before 5.2.0.24 allows a low-privileged attacker to register a second OTP authenticator for the same Active Directory account by exploiting a case-sensitivity mismatch between SEP sesam (case-sensitive) and Active Directory (case-insensitive) username handling. When AD authentication and MFA enforcement are both configured, an attacker can create a duplicate SEP sesam account using a differently-cased variant of an existing AD username, then attach a separate OTP credential to that account - effectively establishing an additional authentication path that circumvents the intended MFA control. No public exploit code exists and the issue is not listed in CISA KEV, but the fix is confirmed in release 5.2.0.24.
MFA weakening in SEP sesam before 5.2.0.24 allows a low-privileged attacker to register a second OTP authenticator for the same Active Directory account by exploiting a case-sensitivity mismatch between SEP sesam (case-sensitive) and Active Directory (case-insensitive) username handling. When AD authentication and MFA enforcement are both configured, an attacker can create a duplicate SEP sesam account using a differently-cased variant of an existing AD username, then attach a separate OTP credential to that account - effectively establishing an additional authentication path that circumvents the intended MFA control. No public exploit code exists and the issue is not listed in CISA KEV, but the fix is confirmed in release 5.2.0.24.