CVE-2026-53660

Summary

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the default configuration initializes the iPlanetDirectoryPro SSO cookie with HttpOnly disabled and without a protective SameSite default, and OAuth and OpenID Connect consent flows reuse that cookie through CsrfProtection as a CSRF token. When combined with same-origin cross-site scripting and a user following an attacker-controlled link, the cookie can be read and reused to steal the SSO session and complete attacker-driven consent grants. This issue is fixed in version 16.1.1.

Affected Software

VendorProductVersion RangeStatus
OpenIdentityPlatformOpenAM< 16.1.1affected

Weaknesses

  • CWE-1004: CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag
  • CWE-1188: CWE-1188: Insecure Default Initialization of Resource
  • CWE-1275: CWE-1275: Sensitive Cookie with Improper SameSite Attribute

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References