HIGH GitHub
CVE-2026-53660
OpenAM Insecure SSO Cookie Initialization
## Summary
**Description**
An Insecure Default Initialization of Resource (CWE-1188) issue in the OpenAM default configuration ships the `iPlanetDirectoryPro` SSO cookie with `HttpOnly=false`. Also, the `iPlanetDirectoryPro` SSO cookie is used as a CSRF token in OAuth/OIDC flows. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1.
## Impact
A single click on an attacker link may yield full SSO session theft of any authenticated console user when chai
Affected Products
- maven/org.openidentityplatform.openam:openam-core < 16.1.1
References
- https://github.com/advisories/GHSA-fpmh-vx4h-xc33
- https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-fpmh-vx4h-xc33
- https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1
- https://github.com/advisories/GHSA-fpmh-vx4h-xc33
This high severity vulnerability was published on 2026-08-14 via GitHub. Affected: maven/org.openidentityplatform.openam:openam-core < 16.1.1.
vulnfeed aggregates 10939 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.