CVE-2026-79300: CWE-180 Incorrect Behavior Order: Validate Before Canonicalize in SEP sesam
SEP sesam before 5.2.0.24 mishandles User Authorization with MFA. If AD authentication is configured and MFA is enforced, an attacker can create a second OTP access capability. SEP sesam and Active Directory handle username capitalization differently, which may allow multiple SEP sesam user accounts to be created for the same Active Directory (AD) account. Active Directory treats usernames as case-insensitive, while SEP sesam distinguishes between different letter casing. As a result, the same AD user can be represented by multiple SEP sesam user accounts that differ only in username capitalization. When Active Directory authentication is configured and multi-factor authentication (MFA) is enforced, this behavior may allow an additional OTP Authenticator to be registered for the same AD account, reducing the effectiveness of MFA protection.
AI Analysis
Technical Summary
CVE-2026-79300 describes a vulnerability in SEP sesam prior to version 5.2.0.24 where the software mishandles user authorization in environments using Active Directory authentication with enforced multi-factor authentication. The root cause is a difference in username case handling: AD treats usernames as case-insensitive, while SEP sesam treats them as case-sensitive. This allows creation of multiple SEP sesam user accounts differing only by username capitalization but linked to the same AD account. Consequently, an attacker may register an additional OTP authenticator for the same AD user, reducing the effectiveness of MFA.
Potential Impact
The vulnerability does not allow direct compromise of confidentiality or availability but can reduce the effectiveness of MFA by permitting multiple OTP authenticators for a single AD account. This could potentially facilitate unauthorized access if an attacker exploits the additional OTP registration capability.
Mitigation Recommendations
No official patch or fix is indicated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be aware of this behavior when using AD authentication with MFA and consider additional compensating controls to monitor or restrict multiple OTP registrations per AD account.
CVE-2026-79300: CWE-180 Incorrect Behavior Order: Validate Before Canonicalize in SEP sesam
Description
SEP sesam before 5.2.0.24 mishandles User Authorization with MFA. If AD authentication is configured and MFA is enforced, an attacker can create a second OTP access capability. SEP sesam and Active Directory handle username capitalization differently, which may allow multiple SEP sesam user accounts to be created for the same Active Directory (AD) account. Active Directory treats usernames as case-insensitive, while SEP sesam distinguishes between different letter casing. As a result, the same AD user can be represented by multiple SEP sesam user accounts that differ only in username capitalization. When Active Directory authentication is configured and multi-factor authentication (MFA) is enforced, this behavior may allow an additional OTP Authenticator to be registered for the same AD account, reducing the effectiveness of MFA protection.
CVSS v3.1
Score 3.5low
Affected software
SEP
sesam
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-79300 describes a vulnerability in SEP sesam prior to version 5.2.0.24 where the software mishandles user authorization in environments using Active Directory authentication with enforced multi-factor authentication. The root cause is a difference in username case handling: AD treats usernames as case-insensitive, while SEP sesam treats them as case-sensitive. This allows creation of multiple SEP sesam user accounts differing only by username capitalization but linked to the same AD account. Consequently, an attacker may register an additional OTP authenticator for the same AD user, reducing the effectiveness of MFA.
Potential Impact
The vulnerability does not allow direct compromise of confidentiality or availability but can reduce the effectiveness of MFA by permitting multiple OTP authenticators for a single AD account. This could potentially facilitate unauthorized access if an attacker exploits the additional OTP registration capability.
Mitigation Recommendations
No official patch or fix is indicated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be aware of this behavior when using AD authentication with MFA and consider additional compensating controls to monitor or restrict multiple OTP registrations per AD account.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-08-25T06:14:33.619Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa5d2f055bf5e2cf5d279ca
Added to database: 09/12/2026, 22:32:16 UTC
Last enriched: 09/12/2026, 22:47:11 UTC
Last updated: 09/13/2026, 01:46:03 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.