A misconfigured cache in OpenText Identity Manager allows a remote authenticated user to read any other user's session data stored in the application cache. The vulnerability is a result of insecure handling of cache files, giving attackers access to confidential session information. The impact is a breach of confidentiality and potential escalation of privileges by a compromised user.

The flaw exists in OpenText Identity Manager 25.2 (v4.10.1) running on Windows or Linux platforms. This version can be obtained from Micro Focus’s product release channels. Only the mentioned version is confirmed affected; earlier releases are not listed as vulnerable.

The CVSS Base Score of 8.4 classifies this flaw as High severity, and although its EPSS score is not available, the attack only requires the attacker to be an authenticated user of the application. The vulnerability is not currently listed in CISA’s KEV catalog, but because it allows cross-user data leakage, it represents a significant risk for organizations that rely on isolated user sessions. Exploitation requires no special network access beyond normal authentication and can be performed by any legitimate user who logs into the affected system. Review of the publicly available references indicates that Micro Focus has released a patch to address the issue, making patching an effective mitigation.