Is CVE-2026-45049 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45049 being exploited in the wild.

How severe is CVE-2026-45049?

High severity, with a CVSS score of 8.3, published 29 October 2026.

Which products and versions are affected?

org.openidentityplatform.openam:openam-federation (Maven) <= 16.0.6, ECOSYSTEM:introduced=0,fixed=16.1.1; Open Identity Platform OpenAM Community Edition <= 16.0.6.

Is there a fix for CVE-2026-45049?

Yes. org.openidentityplatform.openam:openam-federation (Maven): upgrade to 16.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45049 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-45049?

Check whether you run org.openidentityplatform.openam:openam-federation (Maven) or Open Identity Platform OpenAM Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45049: Open Identity Platform OpenAM session hijacking in CDCServlet

Q: Is there a fix for CVE-2026-45049?

Yes. org.openidentityplatform.openam:openam-federation (Maven): upgrade to 16.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45049 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-45049?

Check whether you run org.openidentityplatform.openam:openam-federation (Maven) or Open Identity Platform OpenAM Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45049 · Severity: high · CVSS 8.3 · Published 2026-10-29

OpenAM is an identity and access management platform used to provide single sign-on (SSO) capabilities across different domains. A security flaw in its cross-domain component allows an attacker to steal a user's active login session if they can trick the user into clicking a malicious link. This could allow an attacker to impersonate the user and gain unauthorized access to corporate applications and sensitive data.

Technologies: Open Identity Platform OpenAM Community Edition. Vendors: Maven, Open Identity Platform.

Quick answers

Is CVE-2026-45049 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45049 being exploited in the wild.
How severe is CVE-2026-45049?: High severity, with a CVSS score of 8.3, published 29 October 2026.
Which products and versions are affected?: org.openidentityplatform.openam:openam-federation (Maven) <= 16.0.6, ECOSYSTEM:introduced=0,fixed=16.1.1; Open Identity Platform OpenAM Community Edition <= 16.0.6.
Is there a fix for CVE-2026-45049?: Yes. org.openidentityplatform.openam:openam-federation (Maven): upgrade to 16.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45049 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-45049?: Check whether you run org.openidentityplatform.openam:openam-federation (Maven) or Open Identity Platform OpenAM Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.openidentityplatform.openam:openam-federation (Maven): upgrade to 16.1.1 or later

# set org.openidentityplatform.openam:openam-federation to 16.1.1 in your pom.xml or build.gradle

Technical details

An Information Exposure Through Sent Data (CWE-201) vulnerability exists in the OpenAM Cross-Domain Single Sign-On (CDSSO) servlet. The flaw allows a logged-in user's raw session token to be transmitted via a POST request to an attacker-controlled URL. Exploitation requires the CDSSO component to be enabled (common in multi-domain environments) and requires user interaction, where an authenticated victim is induced to visit a crafted URL. Successful exploitation results in session hijacking. The issue is present in OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1.

Affected products

Open Identity Platform OpenAM Community Edition <= 16.0.6

Identifiers

CVE-2026-45049
GHSA-r9pv-5rpp-vm8g

Timeline

2026-06-23: disclosed
2026-06-23: advisory
16.1.1: patched: First patched version

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.