{"id":"CVE-2026-53660","summary":"OpenAM Insecure SSO Cookie Initialization","details":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the default configuration initializes the iPlanetDirectoryPro SSO cookie with HttpOnly disabled and without a protective SameSite default, and OAuth and OpenID Connect consent flows reuse that cookie through CsrfProtection as a CSRF token. When combined with same-origin cross-site scripting and a user following an attacker-controlled link, the cookie can be read and reused to steal the SSO session and complete attacker-driven consent grants. This issue is fixed in version 16.1.1.","aliases":["GHSA-fpmh-vx4h-xc33"],"modified":"2026-09-17T08:05:16.965261Z","published":"2026-09-15T09:45:01.219Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-1004","CWE-1188","CWE-1275"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53660.json"},"references":[{"type":"WEB","url":"https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53660.json"},{"type":"ADVISORY","url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-fpmh-vx4h-xc33"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53660"},{"type":"FIX","url":"https://github.com/OpenIdentityPlatform/OpenAM/commit/2af597267e6eb9302f75445c2c726f9b84f62966"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openidentityplatform/openam","events":[{"introduced":"0"},{"fixed":"2af597267e6eb9302f75445c2c726f9b84f62966"},{"fixed":"fe2271ec119e827b4252cec20293480322a84789"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"16.1.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["16.0.6","16.0.5","16.0.4","16.0.3","15.2.2","15.2.1","15.2.0","15.1.6","15.1.5","15.1.4","15.1.3","15.1.2","15.1.1","15.1.0","15.0.4","15.0.3","15.0.2","15.0.1","15.0.0","14.8.4","14.8.3","14.8.2","14.8.1","14.7.4","14.7.3","14.7.2","14.7.1","14.7.0","14.6.6","14.6.5","14.6.4","14.6.3","14.6.2","14.5.4","14.5.3","14.5.2","14.5.1","14.4.2","14.4.1","14.3.1","14.2.2","14.2.1","14.1.17","14.1.16","14.1.13","14.1.12","14.1.11","14.1.10","14.1.9","14.1.8","14.1.7","14.1.6","14.1.5","14.1.4","14.1.3","14.1.2","14.1.1","14.0.6","14.0.5","14.0.4","14.0.3","14.0.2","14.0.1","14.0.0","13.0.0","13.0.0-RC10","13.0.0-RC9","13.0.0-RC8","13.0.0-RC7","13.0.0-RC6","13.0.0-RC5","13.0.0-RC4","13.0.0-RC3","13.0.0-RC2","13.0.0-RC1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53660.json","vanir_signatures_modified":"2026-09-17T08:05:16Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["5405360505958099491767459918763571433","59430780643808153572853563199112199249","96994992697435002980468756676682877539","36325704317983833101645042050892642020","81668627539269926185313668324987868797","48832313066470168150331654112605066890","22798899801730273476442944076295137334"],"threshold":0.9},"id":"CVE-2026-53660-0daf8879","signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/2af597267e6eb9302f75445c2c726f9b84f62966","target":{"file":"openam-core/src/main/java/com/sun/identity/setup/ServicesDefaultValues.java"}},{"deprecated":false,"digest":{"function_hash":"52305462381668883006824888177940003598","length":361},"id":"CVE-2026-53660-0ea6500d","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/2af597267e6eb9302f75445c2c726f9b84f62966","target":{"file":"openam-oauth2/src/main/java/org/forgerock/oauth2/restlet/AuthorizeResource.java","function":"AuthorizeResource"}},{"deprecated":false,"digest":{"function_hash":"177921207601881695913823330482845003881","length":4261},"id":"CVE-2026-53660-32db6240","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/2af597267e6eb9302f75445c2c726f9b84f62966","target":{"function":"setServiceConfigValues","file":"openam-core/src/main/java/com/sun/identity/setup/ServicesDefaultValues.java"}},{"deprecated":false,"digest":{"function_hash":"101166373867523827489137630083285271079","length":845},"id":"CVE-2026-53660-479841ae","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/2af597267e6eb9302f75445c2c726f9b84f62966","target":{"file":"openam-oauth2/src/test/java/org/forgerock/oauth2/restlet/AuthorizeResourceTest.java","function":"setup"}},{"deprecated":false,"digest":{"line_hashes":["161607753527478622312659852509809838915","46612706239118215957614869596708562624","140107749659557699160770951588400594583","276863134112717296007334611397630760450"],"threshold":0.9},"id":"CVE-2026-53660-5a5237e5","signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/2af597267e6eb9302f75445c2c726f9b84f62966","target":{"file":"openam-core/src/main/java/com/sun/identity/setup/SetupConstants.java"}},{"deprecated":false,"digest":{"line_hashes":["111170502149403827544730924961227387331","83046033417576906268405147575821932616","326528108487792527496447958379640919677","35362833582338449033331444698611209937","250762050180310754608159752014122959426","13437456559270061451668594530279895798","223644142079745239509661309723632444174","96744002091842121339710203926325539980","300667214244814787044225159813029668771","335145505935947530903146685053614947863","10486296402692833835849219749387140159","10600464774569898992377194676505666609","80208048263829950507886574888038475182","28827892357475801275213838230437439087","292025746695794171460239030421213502459"],"threshold":0.9},"id":"CVE-2026-53660-a7217798","signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/2af597267e6eb9302f75445c2c726f9b84f62966","target":{"file":"openam-oauth2/src/main/java/org/forgerock/oauth2/core/CsrfProtection.java"}},{"source":"https://github.com/openidentityplatform/openam/commit/2af597267e6eb9302f75445c2c726f9b84f62966","target":{"file":"openam-oauth2/src/main/java/org/forgerock/oauth2/restlet/AuthorizeResource.java"},"deprecated":false,"digest":{"line_hashes":["314558146896129794203157062011118922847","169207548133588793282810914677482437891","293794097207546870717282886156848775031","65211643424013413664288748621669979514","20131720631192464418655993718389544785","159600688369921733850334970632132990251","73082612164130437713426395761929656351","246841891989886711502361039966558441386","289879885673616672847042551435349680977","59492727662192167253924237740898355330"],"threshold":0.9},"id":"CVE-2026-53660-a9755013","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"182392814473158680630614160624465925967","length":157},"id":"CVE-2026-53660-aad26d90","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/2af597267e6eb9302f75445c2c726f9b84f62966","target":{"file":"openam-oauth2/src/main/java/org/forgerock/oauth2/restlet/ConsentRequiredResource.java","function":"ConsentRequiredResource"},"deprecated":false},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["205385459146534400055517401876583699112","15987667742561574185881981202248901414","201822732293840560851867129382658762947","195869358348772841553046424668145384092","336787292180262506723797991776845533824"]},"id":"CVE-2026-53660-c446e790","signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/2af597267e6eb9302f75445c2c726f9b84f62966","target":{"file":"openam-oauth2/src/main/java/org/forgerock/oauth2/restlet/DeviceCodeVerificationResource.java"}},{"digest":{"line_hashes":["112164618562627641952915093961676076090","146004035011025513551483829973518804807","183405863849582906116438956970103118058","154876791312603174378546247741933690217","88572271035164225185210345763488428510","101116442942484378159216779110237413580","36582622393946366980698423018492553026","293197666289563780146828697420500361709","75321007999449888979773830307144137215","216810273469790762302792711325715633733","329001732268994462781628592313042473319","11942061635669436930717084140952079600","16566124900888561061284381044447361096","98803429818150195549044753865995116528","23467702434583636161870541937361163618","78509431963108236794489378055750449446","160888137555757395521000580355773128243","171404828137363043948394885716397881977","79702966762822310150149892727013467496","60754556895013998574215328659647856136","179861518703507197131580957588899010139","284762687045093227207753228308052856211","19472839512345349923570506993108839342","72608646953708919452741558088145853843","174931866283244105193288106981783793253","263753449273741356396802309822000541096"],"threshold":0.9},"id":"CVE-2026-53660-c80b8a00","signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/2af597267e6eb9302f75445c2c726f9b84f62966","target":{"file":"openam-oauth2/src/main/java/org/forgerock/oauth2/restlet/ConsentRequiredResource.java"},"deprecated":false},{"digest":{"function_hash":"31580413592299520591211139553300975763","length":312},"id":"CVE-2026-53660-e2fe6dac","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/2af597267e6eb9302f75445c2c726f9b84f62966","target":{"file":"openam-oauth2/src/main/java/org/forgerock/oauth2/core/CsrfProtection.java","function":"isCsrfAttack"},"deprecated":false},{"id":"CVE-2026-53660-ea3e5495","signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/2af597267e6eb9302f75445c2c726f9b84f62966","target":{"file":"openam-oauth2/src/test/java/org/forgerock/oauth2/restlet/AuthorizeResourceTest.java"},"deprecated":false,"digest":{"line_hashes":["91881241261352058440677922282958696658","10395695171365765368577047897438930982","329170668841352756549981169691297357956","65211643424013413664288748621669979514","20131720631192464418655993718389544785","241218046422324694750214886990469913166","77692966979795149414846633578171978471","110408247826225311864048587521469889059","5316055233513887164559892964054872113","291058192965322810358158045199756057656","304329589999913736662454090716369616815","295172542520699205434946957696354266581","74256684672445795707584445804204506946"],"threshold":0.9}},{"digest":{"function_hash":"221194417822557354311226981168175161434","length":495},"id":"CVE-2026-53660-f48906fd","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/2af597267e6eb9302f75445c2c726f9b84f62966","target":{"file":"openam-oauth2/src/main/java/org/forgerock/oauth2/restlet/DeviceCodeVerificationResource.java","function":"DeviceCodeVerificationResource"},"deprecated":false},{"id":"CVE-2026-53660-fe09bb4b","signature_type":"Function","signature_version":"v1","source":"https://github.com/openidentityplatform/openam/commit/2af597267e6eb9302f75445c2c726f9b84f62966","target":{"file":"openam-oauth2/src/main/java/org/forgerock/oauth2/restlet/ConsentRequiredResource.java","function":"getDataModel"},"deprecated":false,"digest":{"function_hash":"315631124736913199098387421731790226475","length":1488}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}