CVE-2026-53660 with a CVSS score of 7.0 is a flaw affecting OpenAM Community Edition. This vulnerability arises from an insecure default initialization where the iPlanetDirectoryPro SSO cookie is configured without the HttpOnly flag and lacks the SameSite attribute. An attacker can exploit this issue by chaining it with a same-origin Cross-Site Scripting (XSS) vulnerability within the OpenAM origin, requiring only a single click on a malicious link by an authenticated user. Once exploited, the attacker gains the capability to hijack full SSO sessions and bypass CSRF protections, as the application improperly reuses the SSO cookie as a CSRF token in OAuth/OIDC flows. The business impact is severe, resulting in unauthorized account access, potential data exfiltration, and the ability to force attacker-driven OAuth consent grants. It is important to note that successful exploitation depends on the prerequisite condition of an existing same-origin XSS vulnerability within the environment.
We recommend you to update org.openidentityplatform.openam:openam-core to version 16.1.2 or later.[/subscribe_to_unlock_form]
CVE-2026-53660 with a CVSS score of 7.0 is a flaw affecting OpenAM Community Edition. This vulnerability arises from an insecure default initialization where the iPlanetDirectoryPro SSO cookie is configured without the HttpOnly flag and lacks the SameSite attribute. An attacker can exploit this issue by chaining it with a same-origin Cross-Site Scripting (XSS) vulnerability within the OpenAM origin, requiring only a single click on a malicious link by an authenticated user. Once exploited, the attacker gains the capability to hijack full SSO sessions and bypass CSRF protections, as the application improperly reuses the SSO cookie as a CSRF token in OAuth/OIDC flows. The business impact is severe, resulting in unauthorized account access, potential data exfiltration, and the ability to force attacker-driven OAuth consent grants. It is important to note that successful exploitation depends on the prerequisite condition of an existing same-origin XSS vulnerability within the environment.
We recommend you to update org.openidentityplatform.openam:openam-core to version 16.1.2 or later.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]