CVE-2026-53660
Published:August 14, 2026
Updated:August 16, 2026
Summary Description An Insecure Default Initialization of Resource (CWE-1188) issue in the OpenAM default configuration ships the "iPlanetDirectoryPro" SSO cookie with "HttpOnly=false". Also, the "iPlanetDirectoryPro" SSO cookie is used as a CSRF token in OAuth/OIDC flows. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1. Impact A single click on an attacker link may yield full SSO session theft of any authenticated console user when chained with any other same-origin XSS in the OpenAM origin. The missing "SameSite" default also widens the CSRF surface. Also, because the consent flow reuses the SSO cookie as its CSRF token, any XSS in the OpenAM origin both steals the session and completes attacker-driven OAuth consent grants in one step. Patch This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.
Affected Packages
org.openidentityplatform.openam:openam-core (JAVA):
Affected version(s) >=14.5.2 <16.1.1Fix Suggestion:
Update to version 16.1.1Related Resources (3)
Do you need more information?
Contact UsCVSS v4
Base Score:
7
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
ACTIVE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
7.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
LOW
Availability
NONE