CVE-2026-79300 Details
Description
SEP sesam before 5.2.0.24 mishandles User Authorization with MFA. If AD authentication is configured and MFA is enforced, an attacker can create a second OTP access capability. SEP sesam and Active Directory handle username capitalization differently, which may allow multiple SEP sesam user accounts to be created for the same Active Directory (AD) account. Active Directory treats usernames as case-insensitive, while SEP sesam distinguishes between different letter casing. As a result, the same AD user can be represented by multiple SEP sesam user accounts that differ only in username capitalization. When Active Directory authentication is configured and multi-factor authentication (MFA) is enforced, this behavior may allow an additional OTP Authenticator to be registered for the same AD account, reducing the effectiveness of MFA protection.
A vulnerability exists in SEP sesam versions prior to 5.2.0.24 that improperly manages user authorization when Active Directory (AD) authentication is used with enforced multi-factor authentication (MFA). This issue arises because AD usernames are case-insensitive, while SEP sesam differentiates between letter casing. Consequently, multiple SEP sesam accounts can be created for a single AD user, each with different username capitalizations. When MFA is enforced, this allows for the registration of an additional one-time password (OTP) authenticator for the same AD account, undermining the MFA protection.
Users are advised to update SEP sesam to version 5.2.0.27 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 12, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wiki.sep.de/wiki/index.php/Release_Notes_5.2.0_Artemis#fixed | [email protected] | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-180 | Incorrect Behavior Order: Validate Before Canonicalize | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SEP sesam | < 5.2.0.24 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 12, 2026 | New CVE Received | [email protected] |