Threats Tagged 'ghsa-86x4-hjp8-8h99'

OpenAM versions prior to 16.1.3 have an improper authorization vulnerability that allows delegated administrators with specific session-destroy privileges to terminate sessions outside their authorized realms. This occurs because the realm checks rely on the requester's realm rather than the target session's realm, enabling cross-realm session destruction.