EUVD-2026-78353

OpenAM Community Edition version 16.0.6 and earlier contains a critical configuration flaw that allows attackers to hijack administrative sessions and grant unauthorized OAuth access through a single user interaction, contingent on the presence of cross-site scripting (XSS) on the same domain. While no public exploit has been identified at time of analysis, the vulnerability carries inherent risk and should not be dismissed as theoretical. Organizations should prioritize immediate inventory, assessment, and mitigation planning for OpenAM deployments until vendor patches become available.

Within 24 hours, conduct a complete inventory of OpenAM Community Edition deployments running version 16.0.6 or earlier and identify all co-resident applications on the same origin that may introduce XSS vectors. Within 7 days, implement interim hardening measures including enabling HttpOnly on the iPlanetDirectoryPro session cookie (if application support permits), deploying XSS-focused Web Application Firewall rules, and evaluating the feasibility of segregating CSRF token generation from session cookies. Within 30 days, contact ForgeRock to confirm patch availability timelines, execute an upgrade to a patched version if available, or develop a longer-term mitigation strategy such as network isolation or platform migration if no remediation timeline is provided.

No vendor-released patch identified at time of analysis. Interim mitigations include: (1) enabling HttpOnly flag on the iPlanetDirectoryPro session cookie if supported by your deployment; (2) implementing strict input validation and output encoding across all web applications on the same domain to prevent XSS; (3) deploying Web Application Firewall rules to detect and block consent flow manipulation; (4) segregating CSRF token generation from the session cookie mechanism where architecturally feasible; (5) restricting OAuth scopes available during consent flows to limit potential damage if unauthorized grants occur.