The Sesame Time web application and its REST v3 API rely solely on a session identifier (USID) to validate requests, but they do not verify that the USID belongs to the user making the request. This flaw, identified as CWE‑639, permits an attacker who has obtained a valid USID to impersonate a victim’s session, read or modify sensitive information such as email addresses, user IDs, roles and corporate data, and effectively compromise confidentiality and possibly integrity. In addition, the application does not revoke old USIDs when a new login occurs, so multiple concurrent sessions can exist; this expands the attack surface by allowing an attacker to persist access or perform repeated exploits without needing to re‑obtain a USID.

Sesame Time’s web application and REST v3 API are affected. All deployments that have not applied the latest available version, which contains the authentication and authorization fixes, remain vulnerable. Since the vulnerability listings do not provide specific version numbers, any installation prior to the most recent update should be considered at risk.

The CVSS score of 8.7 indicates a high severity vulnerability. The vulnerability is not listed in the CISA KEV catalog. The EPSS score of less than 1% indicates a very low probability of exploitation. The attack vector is inferred to be remote, as obtaining a valid USID—through network sniffing, CSRF, or other side channels—suffices to hijack a session. Because the flaw does not involve privilege escalation beyond the victim’s role, the impact is limited to that user’s data, but the presence of multiple active sessions amplifies the overall risk by expanding the potential target set.