{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/openam-community-edition/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenAM Community Edition"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Open Identity Platform"],"content_html":"\u003cp\u003eOpenAM Community Edition through version 16.0.6 contains an insecure default configuration regarding its session management, specifically identified as CWE-1188 (Insecure Default Initialization of Resource). The platform initializes the 'iPlanetDirectoryPro' SSO cookie with the 'HttpOnly' flag set to false and lacks the 'SameSite' attribute. This configuration makes the sensitive session identifier accessible to client-side scripts, facilitating session hijacking if an attacker identifies an existing Cross-Site Scripting (XSS) vulnerability within the OpenAM origin. Furthermore, because OpenAM relies on this same cookie as a CSRF token during OAuth and OIDC consent flows, an attacker can leverage a single XSS instance to both steal the user session and perform unauthorized OAuth consent grants on behalf of the victim. This vulnerability, tracked as CVE-2026-53660, was addressed in the 16.1.1 release of OpenAM Community Edition.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full SSO session theft of any authenticated OpenAM console user. Because the vulnerable cookie serves a dual purpose as both a session identifier and a CSRF token for OAuth flows, a single attacker-controlled link can lead to unauthorized consent grants, potentially granting an attacker persistent access to third-party applications via the victim's account. This affects all deployments of OpenAM Community Edition prior to version 16.1.1.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate OpenAM Community Edition to version 16.1.1 or later to apply the secure cookie configuration defaults.\u003c/li\u003e\n\u003cli\u003eAudit existing web application environments for secondary XSS vulnerabilities that could be leveraged to access the 'iPlanetDirectoryPro' cookie.\u003c/li\u003e\n\u003cli\u003eReview OAuth/OIDC implementation logs for unexpected consent grants or rapid re-authorization patterns associated with specific user sessions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-14T20:06:51Z","date_published":"2026-08-14T20:06:51Z","id":"https://feed.craftedsignal.io/briefs/2026-08-openam-cookie-insecurity/","summary":"OpenAM Community Edition versions prior to 16.1.1 are vulnerable to session theft and unauthorized OAuth consent grants due to insecure SSO cookie initialization (CVE-2026-53660).","title":"Insecure SSO Cookie Configuration in OpenAM","url":"https://feed.craftedsignal.io/briefs/2026-08-openam-cookie-insecurity/"}],"language":"en","title":"CraftedSignal Threat Feed - OpenAM Community Edition","version":"https://jsonfeed.org/version/1.1"}