{"id":"CVE-2026-45049","kind":"vulnerability","aliases":["CVE-2026-45049","GHSA-r9pv-5rpp-vm8g"],"related":[],"title":"OpenAM Unauthenticated Session Hijacking via Information Exposure in CDCServlet","description":"## Summary\n\n**Description**\n\nAn Information Exposure Through Sent Data (CWE-201) issue in OpenAM's Cross-Domain Single Sign-On (CDSSO) servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. This impacts OpenAM Community Edition through version 16.0.6. This issue was patched in version 16.1.1.\n\nAn attacker who can induce a logged-in victim to visit a crafted URL may receive the victim's session credential, which could enable session hijacking.\n\n## Impact\nOpenAM deployments through version 16.0.6 that have CDSSO enabled are potentially affected. The CDSSO component is commonly enabled in multi-domain deployments. Exploitation requires user interaction — an authenticated user must be induced to visit an attacker-crafted URL — and is further gated on a non-default configuration being absent.\n\n## Patch\nThis has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.","summary":"OpenAM's Cross-Domain Single Sign-On servlet sends a logged-in user's raw session token via POST to an attacker-chosen URL. An attacker who lures a victim to a crafted link can take over the victim's session.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"org.openidentityplatform.openam:openam-federation","fixed":["16.1.1"],"affected":"<= 16.0.6","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["cwe-201","java","multi-domain","openam","package","self-hosted","sso"],"not_affected_if":["cdsso-disabled","patched-16.1.1"],"how_to_check":"- Check the `openam-federation` Maven dependency version; affected if at or below `16.0.6`\n- Check whether CDSSO is enabled in the OpenAM configuration (the sources do not name the exact setting)","fix":"- Upgrade `openam-federation` (OpenAM Community Edition) to `16.1.1`","status":"open","published_at":"2026-06-23T17:33:14+00:00","first_seen_at":"2026-10-28T15:34:52+00:00","triaged_at":"2026-10-28T15:35:09+00:00","updated_at":"2026-10-28T15:35:09+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T15:35:09Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `openam-federation` (OpenAM Community Edition) to `16.1.1`","reach":"internet","title":"OpenAM: CDSSO servlet leaks session tokens to attacker-controlled URLs","impact":"high","summary":"OpenAM's Cross-Domain Single Sign-On servlet sends a logged-in user's raw session token via POST to an attacker-chosen URL. An attacker who lures a victim to a crafted link can take over the victim's session.","category":"package","nicknames":[],"who_cares":["openam","self-hosted","java","sso","multi-domain"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker takes over a victim's logged-in OpenAM session","analyst_note":"","how_to_check":"- Check the `openam-federation` Maven dependency version; affected if at or below `16.0.6`\n- Check whether CDSSO is enabled in the OpenAM configuration (the sources do not name the exact setting)","needs_analyst":false,"not_affected_if":["cdsso-disabled","patched-16.1.1"],"who_is_affected":"Deployments of OpenAM Community Edition through 16.0.6 that have CDSSO enabled are potentially affected, since the flaw sits in the CDSSO servlet. CDSSO is commonly used in multi-domain deployments. Installations without CDSSO enabled are likely not exposed, though the sources describe the gating condition only as a non-default configuration.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000635,"input_tokens":3624,"output_tokens":546,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-201':26B,91C '-2026':11A,19A '-45049':12A,20A '16.0.6':132C,172C '16.1.1':139C,230C '5rpp':16A 'absent':219C 'affect':179C 'allow':105C 'attack':62B,66B,122C,141C,205C 'attacker-chosen':61B 'attacker-control':121C 'attacker-craft':204C 'authent':196C 'cdcservlet':9A 'cdsso':103C,175C,181C 'chosen':63B 'common':184C 'communiti':128C,227C 'compon':182C 'configur':217C 'control':123C 'could':163C 'craft':73B,153C,206C 'credenti':161C 'cross':40B,97C 'cross-domain':39B,96C 'cve':10A,18A 'cwe':25B,90C 'data':89C 'default':216C 'deploy':169C,190C 'descript':83C 'domain':30B,41B,98C,189C 'edit':129C,228C 'enabl':164C,176C,185C 'encourag':233C 'exploit':191C 'exposur':7A,86C 'federation':24A 'gate':211C 'ghsa':14A 'ghsa-r9pv-5rpp-vm8g':13A 'hijack':4A,166C 'host':35B 'impact':126C,167C 'induc':144C,200C 'inform':6A,85C 'interact':194C 'issu':92C,134C 'java':27B 'latest':238C 'link':74B 'log':50B,108C,147C 'logged-in':49B,107C,146C 'lure':68B 'may':155C 'multi':29B,188C 'multi-domain':28B,187C 'must':198C 'non':215C 'non-default':214C 'openam':1A,23A,31B,37B,94C,113C,127C,168C,226C 'openam-federation':22A 'org.openidentityplatform.openam':21A 'packag':32B 'patch':136C,220C,224C 'post':58B,118C 'potenti':178C 'r9pv':15A 'raw':54B,112C 'receiv':156C 'releas':239C 'requir':192C 'self':34B 'self-host':33B 'send':47B 'sent':88C 'servlet':46B,104C 'session':3A,55B,81B,114C,160C,165C 'sign':44B,101C 'sign-on':43B,100C 'singl':42B,99C 'sso':36B 'summari':82C 'take':76B 'token':56B,115C 'unauthent':2A 'updat':235C 'url':64B,124C,154C,207C 'user':52B,110C,193C,197C,231C 'version':131C,138C,171C,229C 'via':5A,57B 'victim':70B,79B,149C,158C 'visit':151C,202C 'vm8g':17A","nicknames":[],"mitigations":[],"who_affected":"Deployments of OpenAM Community Edition through 16.0.6 that have CDSSO enabled are potentially affected, since the flaw sits in the CDSSO servlet. CDSSO is commonly used in multi-domain deployments. Installations without CDSSO enabled are likely not exposed, though the sources describe the gating condition only as a non-default configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-06-23T17:33:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-r9pv-5rpp-vm8g","url":"https://github.com/advisories/GHSA-r9pv-5rpp-vm8g","severity":"high","published_at":"2026-06-23T17:33:14+00:00","modified_at":"2026-10-28T15:30:45+00:00","first_seen_at":"2026-10-28T15:34:52+00:00","fetched_at":"2026-10-28T15:34:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}