Executive brief
OpenAM is an identity and access management platform that uses SSO cookies to manage user sessions. The default configuration fails to properly secure the SSO cookie with standard browser protections (HttpOnly and SameSite flags), allowing attackers who exploit any cross-site scripting (XSS) vulnerability in OpenAM to steal authenticated user sessions. Additionally, because the cookie is reused as a CSRF token in OAuth/OIDC flows, a single XSS exploit enables both session theft and unauthorized third-party authorization grants.
Technical details
The vulnerability stems from insecure default initialization of the iPlanetDirectoryPro SSO cookie (CWE-1188, CWE-1004, CWE-1275). The cookie is shipped with HttpOnly=false and lacks a SameSite default, making it accessible to JavaScript and vulnerable to both XSS-based session theft and CSRF attacks. Furthermore, the same SSO cookie is repurposed as a CSRF token in OAuth/OIDC consent flows. An attacker with network access can craft a malicious link that, when clicked by an authenticated OpenAM console user, triggers an XSS payload within the OpenAM origin to steal the cookie and simultaneously grant unauthorized OAuth/OIDC access. No authentication or special privileges are required beyond the victim's active session; the attack requires user interaction (clicking a link). The fix was applied in version 16.1.1 by properly securing the cookie with HttpOnly and SameSite attributes.
Affected products
- Open Identity Platform OpenAM Community Edition <16.1.1
Timeline
- 2026-06-29: disclosed: Published to GitHub Advisory Database
- 2026-08-14: advisory: Reviewed and published as GHSA-fpmh-vx4h-xc33
- 2026-06-29: patched: Fix released in OpenAM 16.1.1