All vulnerabilities
CVE-2026-53660GHSA-fpmh-vx4h-xc33

OpenAM Insecure SSO Cookie Initialization

OpenIdentityPlatform org.openidentityplatform.openam:openam-coremavenLibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.0High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.41%Chance of exploitation activity in the next 30 days, higher than 35% of CVEs. Scored 28 Oct 2026FIRST EPSS
Fixed in16.1.1Fixed versionGitHub
Published15 Sep 2026Updated 28 Oct 2026CVE List

What fixes it

  • 16.1.1org.openidentityplatform.openam:openam-core, mavenGitHub<dependency><groupId>org.openidentityplatform.openam</groupId><artifactId>openam-core</artifactId><version>16.1.1</version></dependency>
  • 16.1.1org.openidentityplatform.openam:openam-core, MavenOSV<dependency><groupId>org.openidentityplatform.openam</groupId><artifactId>openam-core</artifactId><version>16.1.1</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

Description An Insecure Default Initialization of Resource (CWE-1188) issue in the OpenAM default configuration ships the iPlanetDirectoryPro SSO cookie with HttpOnly=false. Also, the iPlanetDirectoryPro SSO cookie is used as a CSRF token in OAuth/OIDC flows. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1.

Impact

A single click on an attacker link may yield full SSO session theft of any authenticated console user when chained with any other same-origin XSS in the OpenAM origin. The missing SameSite default also widens the CSRF surface. Also, because the consent flow reuses the SSO cookie as its CSRF token, any XSS in the OpenAM origin both steals the session and completes attacker-driven OAuth consent grants in one step.

Patch

This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.

Text from GitHub Advisory Database

Affected versions 43

  • org.openidentityplatform.openam:openam-core, maven< 16.1.1GitHub
  • OpenAMaffected: < 16.1.1CVE List
  • org.openidentityplatform.openam:openam-core, Mavenfrom first release, fixed in 16.1.1OSV
  • org.openidentityplatform.openam:openam-core, Maven14.5.2OSV
  • org.openidentityplatform.openam:openam-core, Maven14.5.3OSV
  • org.openidentityplatform.openam:openam-core, Maven14.5.4OSV
  • org.openidentityplatform.openam:openam-core, Maven14.6.1OSV
  • org.openidentityplatform.openam:openam-core, Maven14.6.2OSV
  • org.openidentityplatform.openam:openam-core, Maven14.6.3OSV
  • org.openidentityplatform.openam:openam-core, Maven14.6.4OSV
  • org.openidentityplatform.openam:openam-core, Maven14.6.5OSV
  • org.openidentityplatform.openam:openam-core, Maven14.6.6OSV
  • org.openidentityplatform.openam:openam-core, Maven14.7.0OSV
  • org.openidentityplatform.openam:openam-core, Maven14.7.1OSV
  • org.openidentityplatform.openam:openam-core, Maven14.7.2OSV
  • org.openidentityplatform.openam:openam-core, Maven14.7.3OSV
  • org.openidentityplatform.openam:openam-core, Maven14.7.4OSV
  • org.openidentityplatform.openam:openam-core, Maven14.8.1OSV
  • org.openidentityplatform.openam:openam-core, Maven14.8.2OSV
  • org.openidentityplatform.openam:openam-core, Maven14.8.3OSV
  • org.openidentityplatform.openam:openam-core, Maven14.8.4OSV
  • org.openidentityplatform.openam:openam-core, Maven15.0.0OSV
  • org.openidentityplatform.openam:openam-core, Maven15.0.1OSV
  • org.openidentityplatform.openam:openam-core, Maven15.0.2OSV
  • org.openidentityplatform.openam:openam-core, Maven15.0.3OSV
  • org.openidentityplatform.openam:openam-core, Maven15.0.4OSV
  • org.openidentityplatform.openam:openam-core, Maven15.1.0OSV
  • org.openidentityplatform.openam:openam-core, Maven15.1.1OSV
  • org.openidentityplatform.openam:openam-core, Maven15.1.2OSV
  • org.openidentityplatform.openam:openam-core, Maven15.1.3OSV
  • org.openidentityplatform.openam:openam-core, Maven15.1.4OSV
  • org.openidentityplatform.openam:openam-core, Maven15.1.5OSV
  • org.openidentityplatform.openam:openam-core, Maven15.1.6OSV
  • org.openidentityplatform.openam:openam-core, Maven15.2.0OSV
  • org.openidentityplatform.openam:openam-core, Maven15.2.1OSV
  • org.openidentityplatform.openam:openam-core, Maven15.2.2OSV
  • org.openidentityplatform.openam:openam-core, Maven16.0.1OSV
  • org.openidentityplatform.openam:openam-core, Maven16.0.2OSV
  • org.openidentityplatform.openam:openam-core, Maven16.0.3OSV
  • org.openidentityplatform.openam:openam-core, Maven16.0.4OSV
  • org.openidentityplatform.openam:openam-core, Maven16.0.5OSV
  • org.openidentityplatform.openam:openam-core, Maven16.0.6OSV
  • org.openidentityplatform.openam:openam-core, Maven16.1.0OSV

References 5