Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session management endpoint does not enforce ownership or privilege checks when a low-privileged authenticated user queries session information in deployments using stateful session storage. A requester who knows a target identity identifier can retrieve another user's active session credentials, including credentials for a more privileged account, and use them to hijack that session.

CVE-2026-45048 affects OpenAM (Open Access Management) versions prior to 16.1.1. The vulnerability exists in the SessionRequestHandler component of the session management endpoint, which fails to enforce ownership or privilege checks. A low-privileged authenticated user who knows a target identity identifier can query and retrieve another user's active session credentials, including those belonging to higher-privileged accounts. This allows the attacker to hijack privileged sessions, potentially leading to full account takeover or privilege escalation. The vulnerability only affects deployments using stateful session storage. The issue has been patched in OpenAM version 16.1.1, with fixes available via the official GitHub repository.