OpenAM SSO Cookie Misconfiguration Leads to Session Hijacking

Executive Summary

CVE-2026-53660 is a vulnerability in OpenAM, an access management solution. The issue involves the default initialization of the iPlanetDirectoryPro SSO cookie without HttpOnly protection and without a SameSite attribute. OAuth and OpenID Connect consent flows reuse this cookie as a CSRF token. When combined with same-origin XSS and a user clicking an attacker-controlled link, the cookie can be stolen and reused to hijack SSO sessions or manipulate consent grants.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your OpenAM instance is running a version prior to 16.1.1. Inspect the iPlanetDirectoryPro SSO cookie configuration for missing HttpOnly, Secure, and SameSite attributes. Use browser developer tools to examine cookie attributes during authentication flows.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to steal your SSO session by tricking you into clicking a malicious link, especially if there is a same-origin XSS vulnerability. They could then reuse the stolen cookie to perform unauthorized actions like granting OAuth consent or accessing sensitive data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to user sessions and data, violating confidentiality and integrity requirements in GDPR and HIPAA. Non-compliance may result from insufficient session protection and lack of CSRF safeguards, potentially leading to data breaches and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update OpenAM to version 16.1.1 or later to address the insecure cookie defaults. Ensure the SSO cookie includes HttpOnly, Secure, and SameSite attributes. Replace the OAuth/OIDC consent flow CSRF token with a dedicated anti-CSRF token instead of reusing the SSO cookie.

Useful 0 Not Useful 0