CVE-2026-79300 Auth bypass in sesam
Attackers can bypass MFA by creating duplicate user accounts with different capitalization in SEP sesam when using Active Directory authentication.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-79300?
CVE-2026-79300 is a low-severity authentication bypass vulnerability in SEP sesam, published on 12 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SEP sesam before 5.2.0.24 mishandles User Authorization with MFA. If AD authentication is configured and MFA is enforced, an attacker can create a second OTP access capability. SEP sesam and Active Directory handle username capitalization differently, which may allow multiple SEP sesam user accounts to be created for the same Active Directory (AD) account. Active Directory treats usernames as case-insensitive, while SEP sesam distinguishes between different letter casing. As a result, the same AD user can be represented by multiple SEP sesam user accounts that differ only in username capitalization. When Active Directory authentication is configured and multi-factor authentication (MFA) is enforced, this behavior may allow an additional OTP Authenticator to be registered for the same AD account, reducing the effectiveness of MFA protection.
Weakness: CWE-180
Which versions are affected by CVE-2026-79300?
How do I fix CVE-2026-79300?
No fix has been published for CVE-2026-79300 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-79300 being exploited?
There is no known exploitation of CVE-2026-79300 in the wild and no public exploit code.
Sources
Also known as GHSA-7gr9-32jg-84c9.