Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M

CVE-2026-53660OpenAM Insecure SSO Cookie Initialization

High 7.4

In plain English

A high-severity security flaw in OpenAM from OpenIdentityPlatform. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.4High

Exploit odds (30 days)0.4%top 64.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the default configuration initializes the iPlanetDirectoryPro SSO cookie with HttpOnly disabled and without a protective SameSite default, and OAuth and OpenID Connect consent flows reuse that cookie through CsrfProtection as a CSRF token. When combined with same-origin cross-site scripting and a user following an attacker-controlled link, the cookie can be read and reused to steal the SSO session and complete attacker-driven consent grants. This issue is fixed in version 16.1.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.openidentityplatform.openam:openam-core	16.1.1	GHSA-fpmh-vx4h-xc33

Affected products (as reported)

Vendor	Product	Versions
OpenIdentityPlatform	OpenAM	< 16.1.1

Weakness: CWE-1004, CWE-1188, CWE-1275 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-fpmh-vx4h-xc33 x_refsource_CONFIRM
https://github.com/OpenIdentityPlatform/OpenAM/commit/2af597267e6eb9302f75445c2c726f9b84f62966 x_refsource_MISC
https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1 x_refsource_MISC