Insufficient Access Control in Sesame Time Web App

Executive Summary

CVE-2026-15389 is a high-severity vulnerability in the Sesame Time web application and its REST v3 API. The issue involves insufficient access control in session management.

The system relies solely on the session identifier (USID) to validate user requests without verifying whether the USID legitimately belongs to the user making the request. This means an attacker who obtains a valid USID can impersonate a victim’s session.

Additionally, the vulnerability is worsened by poor session lifecycle management. New logins generate additional USIDs without revoking previous ones, allowing multiple active sessions to coexist. This expands the attack surface and increases the risk of unauthorized access.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for unusual session activity or unauthorized access using valid session identifiers (USIDs). Since the flaw involves session impersonation via USIDs, you can look for signs of exploitation by analyzing logs for the following indicators:

• Multiple active sessions for the same user account, especially if they originate from different IP addresses or geographic locations.
• Unexpected or unauthorized access to sensitive data (e.g., emails, user roles, or corporate data) by a user who did not initiate the session.
• Session tokens (USIDs) being reused or shared across multiple requests without proper validation.

Suggested commands or tools to detect this vulnerability:

• Review web server or application logs for repeated or unusual session token usage. For example, grep for USID values in logs: grep -i 'USID=' /var/log/sesame-time/access.log
• Use network monitoring tools (e.g., Wireshark, Zeek) to inspect HTTP requests for session tokens and check if the same USID is being used across different source IPs.
• Check for multiple active sessions per user by querying the Sesame Time database or session store. For example, if sessions are stored in a database, run a query like: SELECT user_id, COUNT(*) FROM sessions GROUP BY user_id HAVING COUNT(*) > 1;
• Deploy intrusion detection systems (IDS) or web application firewalls (WAF) to alert on anomalous session behavior, such as sudden spikes in session creation or reuse.

Useful 0 Not Useful 0

Impact Analysis

If you are a user of the Sesame Time web application, this vulnerability could have several impacts:

• An attacker could impersonate your session and gain unauthorized access to your confidential information, such as emails, user IDs, and roles.
• The attacker could access corporate data associated with your account, potentially leading to data breaches or leaks of sensitive business information.
• Since multiple active sessions can coexist, the attacker may maintain persistent access even after you log in again, increasing the duration and scope of the compromise.

For organizations using Sesame Time, this vulnerability could result in broader security risks, including unauthorized access to employee or company data, which may lead to further exploitation or compliance violations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can have significant implications for compliance with common standards and regulations:

• GDPR (General Data Protection Regulation): The vulnerability could lead to unauthorized access to personal data, which violates GDPR’s requirements for data protection and confidentiality. Organizations may face penalties if they fail to protect user data adequately.
• HIPAA (Health Insurance Portability and Accountability Act): If the Sesame Time application is used to handle protected health information (PHI), this vulnerability could result in unauthorized access to sensitive health data, violating HIPAA’s security and privacy rules.
• Other regulations: Depending on the industry and jurisdiction, this vulnerability could also impact compliance with standards like ISO 27001, which requires robust access control mechanisms, or sector-specific regulations that mandate the protection of sensitive data.

Organizations using Sesame Time should assess the potential impact on their compliance posture and take corrective actions, such as applying the latest security updates, to mitigate risks.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Apply the latest patch or update for Sesame Time. The vendor has addressed this issue in the latest version, which includes improved authentication mechanisms and stricter authorization checks.
• Revoke all existing sessions and force users to re-authenticate. This ensures that any compromised USIDs are invalidated and cannot be reused by attackers.
• Implement session expiration policies to limit the lifespan of session tokens. For example, enforce short-lived sessions and require re-authentication after a period of inactivity.
• Enable multi-factor authentication (MFA) for all user accounts to add an additional layer of security beyond session tokens.
• Monitor and log all session creation and usage events. Set up alerts for suspicious activity, such as multiple active sessions for a single user or sessions originating from unexpected locations.
• Restrict access to the Sesame Time application and its API to trusted networks or IP ranges using firewalls or network access controls.
• Conduct a thorough review of user permissions and access controls to ensure that users only have access to the data and functions necessary for their roles.

Useful 0 Not Useful 0