Product
OpenAM Community Edition versions prior to 16.1.1 are vulnerable to session theft and unauthorized OAuth consent grants due to insecure SSO cookie initialization (CVE-2026-53660).