TI-2026-82770 Aliases CVE-2026-45049

OpenAM Session Hijacking via CDSSO

LOW 38CWE-201Published 2026-10-29 · Updated 2026-11-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-201.

Summary

OpenAM versions before 16.1.1 contain a CDSSO servlet flaw (CWE-201) that POSTs a logged-in user's raw session token to an attacker-controlled URL. An attacker who lures an authenticated victim to a crafted URL can receive the session credential and hijack the session. The flaw requires CDSSO to be enabled, which is common in multi-domain deployments, and exploitation also requires a non-default configuration to be absent. The CVSS 3.1 base score is 8.3 (HIGH), and the Maven artifact org.openidentityplatform.openam:openam-federation is affected before 16.1.1.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`CDSSO`) servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. An attacker who induces an authenticated victim to visit a crafted URL can receive the session credential and potentially hijack the session. Deployments must have `CDSSO` enabled, as is common in multi-domain deployments, and exploitation is additionally gated on a non-default configuration being absent. This issue is fixed in version 16.1.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00332 26th percentileScored 2026-11-07

Fix Fixed OpenAM (OpenIdentityPlatform): 16.1.1org.openidentityplatform.openam:openam-federation (Maven): 16.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenIdentityPlatform	OpenAM	before 16.1.1	16.1.1	Patch available	CNA
—	org.openidentityplatform.openam:openam-federation (Maven)	before 16.1.1	16.1.1	Patch available	GHSA-r9pv-5rpp-vm8g

OpenAM VendorOpenIdentityPlatform Affected before 16.1.1 Fixed in 16.1.1 Patch available CNA
org.openidentityplatform.openam:openam-federation (Maven) Vendor— Affected before 16.1.1 Fixed in 16.1.1 Patch available GHSA-r9pv-5rpp-vm8g

Remediation

Upgrade OpenAM to version 16.1.1 or later. For the openam-federation Maven artifact, update to 16.1.1 as well.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Fix · CNA OpenAM (OpenIdentityPlatform) Fixed in 16.1.1
Fix · GHSA-r9pv-5rpp-vm8g org.openidentityplatform.openam:openam-federation (Maven) Fixed in 16.1.1 Advisory →

Timeline

2026-10-29 Threatist record created from CVE-2026-45049
2026-10-31 Priority changed: MEDIUM → LOW
2026-11-04 CISA SSVC decision points changed

References

Other 4

TI-2025-20332 OpenDJ Denial of Service (Dos) using alias loop CVSS 4.0HIGH 8.7
TI-2026-25836 Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM CVSS 4.0CRITICAL 9.3
TI-2026-86693 Session token disclosure in OpenAM notification WebSocket CVSS 4.0CRITICAL 10.0
TI-2026-86692 Authentication bypass in OpenAM SAML login accepts unsigned assertions CVSS 4.0CRITICAL 9.3
TI-2026-86691 Privilege escalation in OpenAM via self-registration attribute bypass CVSS 4.0CRITICAL 9.3
TI-2026-86685 Unbounded Java deserialization in OpenAM enables denial of service CVSS 4.0HIGH 8.7

See all 54 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences