What is the CVSS score of CVE-2026-45049?

CVE-2026-45049 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H.

Which versions of OpenAM are affected by CVE-2026-45049?

OpenAM Community Edition versions through 16.0.6 contain a session token disclosure vulnerability enabling account hijacking when CDSSO is enabled, with no public exploit identified at time of…. A patch is available.

How to fix or mitigate CVE-2026-45049?

Within 24 hours: Identify all OpenAM Community Edition instances running versions through 16.0.6 and determine if CDSSO is enabled. Within 7 days: Test upgrade to OpenAM Community Edition version 16.1.1 in a staging environment and validate CDSSO functionality. Within 30 days: Deploy version 16.1.1 to all production OpenAM instances.

OpenAM CVE-2026-45049

HIGH

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-06-23 https://github.com/OpenIdentityPlatform/OpenAM

GHSA-r9pv-5rpp-vm8g

Information Disclosure

8.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network-reachable servlet, no attacker auth, but requires victim click plus CDSSO enabled and missing hardening config (AC:H, UI:R); stolen session yields full C/I/A on downstream apps (scope change).

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 23, 2026 - 18:30 vuln.today

Analysis Generated

Jun 23, 2026 - 18:30 vuln.today

DescriptionGitHub Advisory

Summary

Description

An Information Exposure Through Sent Data (CWE-201) issue in OpenAM's Cross-Domain Single Sign-On (CDSSO) servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. This impacts OpenAM Community Edition through version 16.0.6. This issue was patched in version 16.1.1.

An attacker who can induce a logged-in victim to visit a crafted URL may receive the victim's session credential, which could enable session hijacking.

Impact

OpenAM deployments through version 16.0.6 that have CDSSO enabled are potentially affected. The CDSSO component is commonly enabled in multi-domain deployments. Exploitation requires user interaction - an authenticated user must be induced to visit an attacker-crafted URL - and is further gated on a non-default configuration being absent.

Patch

This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.

AnalysisAI

Session token disclosure in OpenAM Community Edition through 16.0.6 allows a remote attacker to harvest an authenticated victim's raw OpenAM session credential by tricking them into visiting a crafted URL that abuses the Cross-Domain Single Sign-On (CDSSO) servlet to POST the token to an attacker-controlled endpoint. Successful exploitation enables full session hijacking against deployments where CDSSO is enabled and a specific non-default hardening configuration is absent. No public exploit identified at time of analysis, but the upstream advisory (GHSA-r9pv-5rpp-vm8g) confirms the flaw and ships a fix in 16.1.1.

Technical ContextAI

OpenAM is the Open Identity Platform fork of the legacy ForgeRock/Sun OpenAM access management server, providing authentication, SSO, and federation services for Java web applications. The vulnerable component is the CDCServlet inside the openam-federation Maven module (pkg:maven/org.openidentityplatform.openam:openam-federation), which implements Cross-Domain Single Sign-On by relaying authentication artifacts between OpenAM and applications hosted on different DNS domains. CWE-201 (Information Exposure Through Sent Data) describes the root cause: the servlet propagates the user's raw session token into an outbound HTTP POST whose destination URL is influenced by attacker-controllable input rather than being strictly validated against a trusted allow-list, so the token leaks to an arbitrary endpoint along with the legitimate redirect.

RemediationAI

Vendor-released patch: OpenAM Community Edition 16.1.1 - upgrade openam-federation and the wider OpenAM distribution to 16.1.1 or later as the primary fix, per advisory GHSA-r9pv-5rpp-vm8g (https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-r9pv-5rpp-vm8g). Where immediate upgrade is not possible, operators should disable the Cross-Domain Single Sign-On feature on the affected OpenAM instances (which removes the attack surface but breaks legitimate multi-domain SSO flows), restrict the CDCServlet endpoint at a reverse proxy or WAF to known-good Goto/redirect destinations, and enable the non-default hardening configuration referenced in the advisory to constrain CDSSO redirect targets to an allow-list. Complementary controls include shortening OpenAM session lifetimes, binding sessions to client attributes where supported, and user-awareness measures against suspicious SSO links - none of which are substitutes for applying 16.1.1.