CVE-2026-53660

Open Access Management (OpenAM) versions before 16.1.1 ship with an insecure default configuration in which the iPlanetDirectoryPro SSO cookie is set without the HttpOnly flag and without a SameSite default, leaving it readable by JavaScript. Worse, OAuth 2.0 and OpenID Connect consent flows reuse this same cookie as the CSRF token via CsrfProtection, so a readable session cookie also undermines CSRF defenses. An attacker who combines a same-origin cross-site scripting flaw in the deployment with a victim following an attacker-controlled link can read the cookie, hijack the victim's SSO session, and complete attacker-driven consent grants for OAuth/OIDC applications. Any organization running a default-configured OpenAM deployment below 16.1.1 that also hosts an XSS weakness is affected; exploitation requires user interaction and multiple conditions (CVSS 4.0: 7.4, high). No public proof of concept is known and the issue is not in CISA's KEV catalog, so there is no indication of in-the-wild exploitation.

What to do: Upgrade to OpenAM 16.1.1 or later, which enables HttpOnly and applies a protective SameSite default for the iPlanetDirectoryPro cookie. Until patched, manually enable HttpOnly and set an appropriate SameSite attribute on the SSO cookie in configuration, and audit deployments for same-origin XSS that could be chained with this flaw. Review OAuth/OIDC consent grant logs and issued tokens for unauthorized grants, and revoke any suspicious sessions.