CVSS 4.0
7.4 highCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NCVE-2026-53660
High (7.4). EPSS 0.4% chance of exploitation in the next 30 days. Fixed in org.openidentityplatform.openam:openam-core 16.1.1.
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the default configuration initializes the iPlanetDirectoryPro SSO cookie with HttpOnly disabled and without a protective SameSite default, and OAuth and OpenID Connect consent flows reuse that cookie through CsrfProtection as a CSRF token. When combined with same-origin cross-site scripting and a user following an attacker-controlled link, the cookie can be read and reused to steal the SSO session and complete attacker-driven consent grants. This issue is fixed in version 16.1.1.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-1004, CWE-1188, CWE-1275
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-fpmh-vx4h-xc33 | Maven | org.openidentityplatform.openam:openam-core | <16.1.1 | 16.1.1 |