CVE-2026-15389 Inadequate access control in Sesame Time session management
Attackers can impersonate users and access confidential data by exploiting inadequate session validation in Sesame Time.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-15389?
CVE-2026-15389 is a high-severity authentication bypass vulnerability in Sesame Time, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability relating to insufficient access control has been identified in the session management of the Sesame Time web application and its REST v3 API. The flaw lies in the fact that the system uses the session identifier (USID) as the sole validation mechanism, without verifying whether that identifier legitimately belongs to the user making the request. As a result, an attacker who obtains a valid USID can impersonate a victim’s session and access their confidential information, including emails, user IDs, roles and corporate data. This vulnerability is exacerbated by poor session lifecycle management: new logins generate additional USIDs without revoking the previous ones, allowing multiple active sessions to coexist and thereby expanding the attack surface.
Weakness: CWE-639
Which versions are affected by CVE-2026-15389?
How do I fix CVE-2026-15389?
No fix has been published for CVE-2026-15389 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-15389 being exploited?
There is no known exploitation of CVE-2026-15389 in the wild and no public exploit code.
Sources
Also known as GHSA-98qr-jpxv-vfp8.