CVE-2026-45049

Received Received - Intake

Session Token Exposure in OpenAM via CDSSO Servlet

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: GitHub, Inc.

Description

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`CDSSO`) servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. An attacker who induces an authenticated victim to visit a crafted URL can receive the session credential and potentially hijack the session. Deployments must have `CDSSO` enabled, as is common in multi-domain deployments, and exploitation is additionally gated on a non-default configuration being absent. This issue is fixed in version 16.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-29

Last Modified

2026-10-29

Generated

2026-10-30

AI Q&A

2026-10-30

EPSS Evaluated

N/A

NVD

CVE-2026-45049

EUVD

EUVD-2026-113394

Affected Vendors & Products

Vendor	Product	Version / Range
OpenIdentityPlatform	OpenAM	< 16.1.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-201	The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Attack-Flow Graph

Executive Summary

OpenAM before version 16.1.1 has a vulnerability in the Cross-Domain Single Sign-On (CDSSO) servlet. It allows a logged-in user's raw OpenAM session token to be sent to an attacker-controlled URL via a POST request. An attacker can trick an authenticated victim into visiting a crafted URL to steal the session token and hijack the session.

Detection Guidance

Check if OpenAM version is prior to 16.1.1. Inspect network traffic for POST requests to attacker-controlled URLs containing raw session tokens. Review CDSSO servlet logs for unusual activity.

Impact Analysis

If exploited, this vulnerability could allow an attacker to hijack an authenticated user's session by stealing their OpenAM session token. This could lead to unauthorized access to sensitive data or systems, depending on the permissions of the hijacked session.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, which may violate compliance requirements under GDPR or HIPAA. Organizations using affected OpenAM versions may face regulatory penalties or breaches of data protection obligations.

Mitigation Strategies

Upgrade OpenAM to version 16.1.1 or later. Disable CDSSO if not required. Implement network-level protections to block POST requests to untrusted URLs.

Hi! I’m here to help you understand CVE-2026-45049. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70