MFA Vulnerability Found in SEP sesam by SEP Security

CVE-2026-79300

What is CVE-2026-79300?

SEP sesam versions before 5.2.0.24 exhibit a flaw in user authorization when integrated with multi-factor authentication (MFA) and Active Directory (AD). The issue arises due to a discrepancy in how user names are treated: while Active Directory's handling of usernames is case-insensitive, SEP sesam differentiates based on capitalization. This inconsistency could enable an attacker to establish multiple SEP sesam user accounts linked to a single AD account by exploiting different username case variations. Consequently, in environments where AD authentication is configured along with enforced MFA, the vulnerability presents a risk of unauthorized OTP access capabilities, potentially undermining the security benefits of MFA.

References