Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.openidentityplatform.openam:openam-federation

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.3MavenAmendedPublished

    OpenAM Unauthenticated Session Hijacking via Information Exposure in CDCServlet

    CVE-2026-45049 · GHSA-r9pv-5rpp-vm8g

    Affected
    • Maven org.openidentityplatform.openam:openam-federation < 16.1.1
    Fixed in
    16.1.1· Vendor fix available
    Issue
    Description An Information Exposure Through Sent Data (CWE-201) issue in OpenAM's Cross-Domain Single Sign-On (CDSSO) servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. This impacts OpenAM Community Edition through version 16.0.6. This issue was patched in version 16.1.1. An attacker who can induce a logged-in victim to visit a crafted URL may receive the victim's session credential, which could enable session hijacking. Impact OpenAM deployments through version 16.0.6 that have CDSSO enabled are potentially affected. The CDSSO component is commonly enabled in multi-domain deployments. Exploitation requires user interaction — an authenticated user must be induced to visit an attacker-crafted URL — and is further gated on a non-default configuration being absent. Patch This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.

    Recommended action: Upgrade to 16.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →