Live › vulnerability › CVE-2026-45049
Go to dashboardOpenAM's Cross-Domain Single Sign-On servlet sends a logged-in user's raw session token via POST to an attacker-chosen URL. An attacker who lures a victim to a crafted link can take over the victim's session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 15:34 UTC. All times on this page are UTC.
Deployments of OpenAM Community Edition through 16.0.6 that have CDSSO enabled are potentially affected, since the flaw sits in the CDSSO servlet. CDSSO is commonly used in multi-domain deployments. Installations without CDSSO enabled are likely not exposed, though the sources describe the gating condition only as a non-default configuration.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.openidentityplatform.openam:openam-federation | maven | <= 16.0.6 | 16.1.1 |
openam-federation Maven dependency version; affected if at or below 16.0.6openam-federation (OpenAM Community Edition) to 16.1.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Description
An Information Exposure Through Sent Data (CWE-201) issue in OpenAM's Cross-Domain Single Sign-On (CDSSO) servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. This impacts OpenAM Community Edition through version 16.0.6. This issue was patched in version 16.1.1.
An attacker who can induce a logged-in victim to visit a crafted URL may receive the victim's session credential, which could enable session hijacking.
OpenAM deployments through version 16.0.6 that have CDSSO enabled are potentially affected. The CDSSO component is commonly enabled in multi-domain deployments. Exploitation requires user interaction — an authenticated user must be induced to visit an attacker-crafted URL — and is further gated on a non-default configuration being absent.
This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.
This page as .md · .json · in your agent: get_signal("CVE-2026-45049")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.