How to fix or mitigate CVE-2026-53660?

Within 24 hours, conduct a complete inventory of OpenAM Community Edition deployments running version 16.0.6 or earlier and identify all co-resident applications on the same origin that may introduce XSS vectors. Within 7 days, implement interim hardening measures including enabling HttpOnly on the iPlanetDirectoryPro session cookie (if application support permits), deploying XSS-focused Web Application Firewall rules, and evaluating the feasibility of segregating CSRF token generation from session cookies. Within 30 days, contact ForgeRock to confirm patch availability timelines, execute an upgrade to a patched version if available, or develop a longer-term mitigation strategy such as network isolation or platform migration if no remediation timeline is provided.

CVE-2026-53660

Q: What is the CVSS score of CVE-2026-53660?

CVE-2026-53660 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-78353 HIGH

Sensitive Cookie Without 'HttpOnly' Flag (CWE-1004)

2026-08-14 https://github.com/OpenIdentityPlatform/OpenAM

GHSA-fpmh-vx4h-xc33

XSS CSRF

7.4

CVSS 4.0 · Vendor: https://github.com/OpenIdentityPlatform/OpenAM

Severity by source

Vendor (https://github.com/OpenIdentityPlatform/OpenAM) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.0 HIGH

Network vector, high complexity (requires chaining with same-origin XSS), no attacker privileges needed, user interaction required, scope changed via OAuth grants, high confidentiality and integrity impact from session and consent hijack.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:H/SA:N

Primary rating from Vendor (https://github.com/OpenIdentityPlatform/OpenAM).

CVSS VectorVendor: https://github.com/OpenIdentityPlatform/OpenAM

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Sep 15, 2026 - 10:32 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 15, 2026 - 10:22 vuln.today

cvss_changed

CVSS changed

Sep 15, 2026 - 10:22 NVD

7.4 (HIGH)

Source Code Evidence Fetched

Aug 14, 2026 - 19:51 vuln.today

Analysis Generated

Aug 14, 2026 - 19:51 vuln.today

CVE Published

Aug 14, 2026 - 19:25 cve.org

HIGH

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

55 maven packages depend on org.openidentityplatform.openam:openam-core (51 direct, 4 indirect)

Ecosystem-wide dependent count for version 16.1.1.

DescriptionCVE.org

Summary

Description An Insecure Default Initialization of Resource (CWE-1188) issue in the OpenAM default configuration ships the iPlanetDirectoryPro SSO cookie with HttpOnly=false. Also, the iPlanetDirectoryPro SSO cookie is used as a CSRF token in OAuth/OIDC flows. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1.

Impact

A single click on an attacker link may yield full SSO session theft of any authenticated console user when chained with any other same-origin XSS in the OpenAM origin. The missing SameSite default also widens the CSRF surface. Also, because the consent flow reuses the SSO cookie as its CSRF token, any XSS in the OpenAM origin both steals the session and completes attacker-driven OAuth consent grants in one step.

Patch

This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.

AnalysisAI

OpenAM Community Edition through 16.0.6 ships its iPlanetDirectoryPro SSO session cookie with HttpOnly disabled and no SameSite attribute by default, and reuses that same cookie value as the CSRF token for the OAuth/OIDC consent flow. When chained with any other same-origin XSS in the OpenAM console, a single clicked attacker link lets a remote, unauthenticated attacker read the cookie from document.cookie, hijack a logged-in console user's full SSO session, and simultaneously submit attacker-controlled OAuth consent grants using the stolen cookie as the anti-CSRF token. The issue is fixed by