CVE-2026-45049

HIGH 8.3

OpenAM Session Hijacking via CDSSO

CVSS Score

8.3

EPSS Score

0.0%

EPSS Percentile

0th

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`CDSSO`) servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. An attacker who induces an authenticated victim to visit a crafted URL can receive the session credential and potentially hijack the session. Deployments must have `CDSSO` enabled, as is common in multi-domain deployments, and exploitation is additionally gated on a non-default configuration being absent. This issue is fixed in version 16.1.1.

CWE	CWE-201
Vendor	openidentityplatform
Product	openam
Published	Oct 29, 2026

Stay Ahead of the Next One

Get instant alerts for openidentityplatform openam

Be the first to know when new high vulnerabilities affecting openidentityplatform openam are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

OpenIdentityPlatform / OpenAM

< 16.1.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-r9pv-5rpp-vm8g github.com: https://github.com/OpenIdentityPlatform/OpenAM/commit/bda647f8540d8fb28aaaed716914692678c5a0a7 github.com: https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1