All vulnerabilities
CVE-2026-45049GHSA-r9pv-5rpp-vm8g

OpenAM Unauthenticated Session Hijacking via Information Exposure in CDCServlet

org.openidentityplatform.openam:openam-federationmavenLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.3High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in16.1.1Fixed versionGitHub
Published23 Jun 2026Updated 28 Oct 2026GitHub

What fixes it

  • 16.1.1org.openidentityplatform.openam:openam-federation, mavenGitHub<dependency><groupId>org.openidentityplatform.openam</groupId><artifactId>openam-federation</artifactId><version>16.1.1</version></dependency>
  • 16.1.1org.openidentityplatform.openam:openam-federation, MavenOSV<dependency><groupId>org.openidentityplatform.openam</groupId><artifactId>openam-federation</artifactId><version>16.1.1</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

Description

An Information Exposure Through Sent Data (CWE-201) issue in OpenAM's Cross-Domain Single Sign-On (CDSSO) servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. This impacts OpenAM Community Edition through version 16.0.6. This issue was patched in version 16.1.1.

An attacker who can induce a logged-in victim to visit a crafted URL may receive the victim's session credential, which could enable session hijacking.

Impact

OpenAM deployments through version 16.0.6 that have CDSSO enabled are potentially affected. The CDSSO component is commonly enabled in multi-domain deployments. Exploitation requires user interaction — an authenticated user must be induced to visit an attacker-crafted URL — and is further gated on a non-default configuration being absent.

Patch

This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.

Text from GitHub Advisory Database

Affected versions 42

  • org.openidentityplatform.openam:openam-federation, maven<= 16.0.6GitHub
  • org.openidentityplatform.openam:openam-federation, Mavenfrom first release, fixed in 16.1.1OSV
  • org.openidentityplatform.openam:openam-federation, Maven14.5.2OSV
  • org.openidentityplatform.openam:openam-federation, Maven14.5.3OSV
  • org.openidentityplatform.openam:openam-federation, Maven14.5.4OSV
  • org.openidentityplatform.openam:openam-federation, Maven14.6.1OSV
  • org.openidentityplatform.openam:openam-federation, Maven14.6.2OSV
  • org.openidentityplatform.openam:openam-federation, Maven14.6.3OSV
  • org.openidentityplatform.openam:openam-federation, Maven14.6.4OSV
  • org.openidentityplatform.openam:openam-federation, Maven14.6.5OSV
  • org.openidentityplatform.openam:openam-federation, Maven14.6.6OSV
  • org.openidentityplatform.openam:openam-federation, Maven14.7.0OSV
  • org.openidentityplatform.openam:openam-federation, Maven14.7.1OSV
  • org.openidentityplatform.openam:openam-federation, Maven14.7.2OSV
  • org.openidentityplatform.openam:openam-federation, Maven14.7.3OSV
  • org.openidentityplatform.openam:openam-federation, Maven14.7.4OSV
  • org.openidentityplatform.openam:openam-federation, Maven14.8.1OSV
  • org.openidentityplatform.openam:openam-federation, Maven14.8.2OSV
  • org.openidentityplatform.openam:openam-federation, Maven14.8.3OSV
  • org.openidentityplatform.openam:openam-federation, Maven14.8.4OSV
  • org.openidentityplatform.openam:openam-federation, Maven15.0.0OSV
  • org.openidentityplatform.openam:openam-federation, Maven15.0.1OSV
  • org.openidentityplatform.openam:openam-federation, Maven15.0.2OSV
  • org.openidentityplatform.openam:openam-federation, Maven15.0.3OSV
  • org.openidentityplatform.openam:openam-federation, Maven15.0.4OSV
  • org.openidentityplatform.openam:openam-federation, Maven15.1.0OSV
  • org.openidentityplatform.openam:openam-federation, Maven15.1.1OSV
  • org.openidentityplatform.openam:openam-federation, Maven15.1.2OSV
  • org.openidentityplatform.openam:openam-federation, Maven15.1.3OSV
  • org.openidentityplatform.openam:openam-federation, Maven15.1.4OSV
  • org.openidentityplatform.openam:openam-federation, Maven15.1.5OSV
  • org.openidentityplatform.openam:openam-federation, Maven15.1.6OSV
  • org.openidentityplatform.openam:openam-federation, Maven15.2.0OSV
  • org.openidentityplatform.openam:openam-federation, Maven15.2.1OSV
  • org.openidentityplatform.openam:openam-federation, Maven15.2.2OSV
  • org.openidentityplatform.openam:openam-federation, Maven16.0.1OSV
  • org.openidentityplatform.openam:openam-federation, Maven16.0.2OSV
  • org.openidentityplatform.openam:openam-federation, Maven16.0.3OSV
  • org.openidentityplatform.openam:openam-federation, Maven16.0.4OSV
  • org.openidentityplatform.openam:openam-federation, Maven16.0.5OSV
  • org.openidentityplatform.openam:openam-federation, Maven16.0.6OSV
  • org.openidentityplatform.openam:openam-federation, Maven16.1.0OSV

References 4