# CVE-2026-53660: OpenAM insecure SSO cookie initialization

Source: https://junglewise.ai/threats/cve-2026-53660-openam-insecure-sso-cookie-initialization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-24  
License: CC BY 4.0 with a link back

CVE-2026-53660 · Severity: high · CVSS 4 · Published 2026-09-15

OpenAM is an identity and access management platform that uses SSO cookies to manage user sessions. The default configuration fails to properly secure the SSO cookie with standard browser protections (HttpOnly and SameSite flags), allowing attackers who exploit any cross-site scripting (XSS) vulnerability in OpenAM to steal authenticated user sessions. Additionally, because the cookie is reused as a CSRF token in OAuth/OIDC flows, a single XSS exploit enables both session theft and unauthorized third-party authorization grants.

Technologies: [org.openidentityplatform.openam:openam-core (Maven)](https://junglewise.ai/threats/technologies/org-openidentityplatform-openam-openam-core), [Open Identity Platform OpenAM](https://junglewise.ai/threats/technologies/openam). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Open Identity Platform](https://junglewise.ai/threats/vendors/open-identity-platform).

## Quick answers

**Is CVE-2026-53660 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53660 being exploited in the wild.

**How severe is CVE-2026-53660?** High severity, with a CVSS score of 4, published 15 September 2026.

**Which products and versions are affected?** org.openidentityplatform.openam:openam-core (Maven) < 16.1.1, ECOSYSTEM:introduced=0,fixed=16.1.1; Open Identity Platform OpenAM <16.1.1.

**Is there a fix for CVE-2026-53660?** Yes. org.openidentityplatform.openam:openam-core (Maven): upgrade to 16.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53660 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-53660?** Check whether you run org.openidentityplatform.openam:openam-core (Maven) or Open Identity Platform OpenAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.openidentityplatform.openam:openam-core (Maven): upgrade to 16.1.1 or later

  ```sh
  # set org.openidentityplatform.openam:openam-core to 16.1.1 in your pom.xml or build.gradle
  ```


## Technical details

The vulnerability stems from insecure default initialization of the iPlanetDirectoryPro SSO cookie (CWE-1188, CWE-1004, CWE-1275). The cookie is shipped with HttpOnly=false and lacks a SameSite default, making it accessible to JavaScript and vulnerable to both XSS-based session theft and CSRF attacks. Furthermore, the same SSO cookie is repurposed as a CSRF token in OAuth/OIDC consent flows. An attacker with network access can craft a malicious link that, when clicked by an authenticated OpenAM console user, triggers an XSS payload within the OpenAM origin to steal the cookie and simultaneously grant unauthorized OAuth/OIDC access. No authentication or special privileges are required beyond the victim's active session; the attack requires user interaction (clicking a link). The fix was applied in version 16.1.1 by properly securing the cookie with HttpOnly and SameSite attributes.

## Affected products

- Open Identity Platform OpenAM Community Edition <16.1.1

## Identifiers

- CVE-2026-53660
- GHSA-fpmh-vx4h-xc33

## Timeline

- 2026-06-29: disclosed: Published to GitHub Advisory Database
- 2026-08-14: advisory: Reviewed and published as GHSA-fpmh-vx4h-xc33
- 2026-06-29: patched: Fix released in OpenAM 16.1.1

## References

- [https://api.github.com/users/wodzen](https://api.github.com/users/wodzen)
- [https://github.com/wodzen](https://github.com/wodzen)
- [https://api.github.com/users/wodzen/gists%7B/gist_id%7D](https://api.github.com/users/wodzen/gists%7B/gist_id%7D)
- [https://api.github.com/users/wodzen/repos](https://api.github.com/users/wodzen/repos)
- [https://avatars.githubusercontent.com/u/25558174?v=4](https://avatars.githubusercontent.com/u/25558174?v=4)
- [https://api.github.com/users/wodzen/events%7B/privacy%7D](https://api.github.com/users/wodzen/events%7B/privacy%7D)

## Related threats

- [OpenAM default credentials authentication bypass in built-in identities](https://junglewise.ai/threats/cve-2026-123553-openam-before-16-1-4-ships-built-in-identities-in-the-top-level)
- [OpenAM unauthenticated session token disclosure via WebSocket](https://junglewise.ai/threats/cve-2026-123551-openam-from-14-0-0-before-16-1-4-contains-an-information)
- [OpenAM SAML v2.0 service provider authentication bypass](https://junglewise.ai/threats/cve-2026-123550-openam-before-16-1-4-contains-an-authentication-bypass)
- [OpenAM self-registration attribute list enforcement bypass](https://junglewise.ai/threats/cve-2026-123549-openam-before-16-1-4-fails-to-enforce-the-valid-creation)
- [OpenAM open redirect via SAML RelayState](https://junglewise.ai/threats/cve-2026-123547-openam-before-16-1-4-contains-an-open-redirect-vulnerability)