CVE-2026-45049: 
Java vulnerability analysis and mitigation

CVE-2026-45049 is an Information Exposure Through Sent Data vulnerability (CWE-201) in OpenAM's Cross-Domain Single Sign-On (CDSSO) servlet (CDCServlet) that allows an authenticated user's raw session token to be POSTed to an attacker-controlled URL, enabling session hijacking. It affects OpenAM Community Edition through version 16.0.6 (Maven package org.openidentityplatform.openam:openam-federation). The vulnerability was disclosed and patched on June 23, 2026, with the fix available in version 16.1.1. It carries a CVSS v3.1 base score of 8.3 (High) (GitHub Advisory, OpenAM Advisory).

The root cause is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data): the CDCServlet component, which handles CDSSO flows, transmits the user's raw OpenAM session token via an HTTP POST to a URL that can be attacker-controlled. The attack vector is network-based and requires no privileges, but does require user interaction — a logged-in victim must be induced to visit a crafted URL. Exploitation is further gated on the absence of a non-default protective configuration, meaning deployments with CDSSO enabled and without that additional safeguard are at risk. No public proof-of-concept code has been identified at this time (GitHub Advisory, OpenAM Advisory).

Successful exploitation allows an unauthenticated attacker to obtain a valid OpenAM session token belonging to an authenticated victim, enabling full session hijacking without needing the victim's credentials. Because OpenAM is an identity and access management platform commonly used in multi-domain SSO deployments, a hijacked session could grant the attacker access to all applications and services protected by that OpenAM instance. The CVSS scope is marked as Changed, reflecting that the impact extends beyond the OpenAM component itself to downstream protected resources, with high confidentiality, integrity, and availability impacts (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the disclosure date. The CVE status remains "Reserved" and no EPSS score or CISA KEV catalog entry has been identified. Exploitation requires social engineering to induce an authenticated user to visit a crafted URL, and is additionally gated on a non-default configuration being absent, which somewhat limits opportunistic exploitation. The vulnerability was reported by researcher "wodzen" and patched by the OpenAM maintainers (GitHub Advisory, OpenAM Advisory).

1. Reconnaissance: Identify OpenAM deployments running version 16.0.6 or earlier with CDSSO enabled, typically found in multi-domain enterprise SSO environments.
2. Craft malicious URL: Construct a URL targeting the CDCServlet endpoint (e.g., /openam/cdcservlet) with a manipulated goto or redirect parameter pointing to an attacker-controlled server.
3. Deliver the payload: Use phishing, malicious links, or cross-site request forgery techniques to induce an authenticated OpenAM user to visit the crafted URL.
4. Capture session token: When the victim visits the URL, the CDCServlet POSTs the victim's raw OpenAM session token to the attacker-controlled endpoint, where it is logged or captured.
5. Session hijacking: Use the captured session token in subsequent requests to OpenAM-protected applications, impersonating the victim and gaining access to all resources their session permits (GitHub Advisory, OpenAM Advisory).

• Network: Unexpected outbound HTTP POST requests from the OpenAM server to external or unknown URLs originating from the CDCServlet endpoint; POST requests containing session token parameters (tokenid, sid, or similar) to non-whitelisted domains.
• Logs: OpenAM access logs showing requests to /openam/cdcservlet (or equivalent) with unusual or external goto parameter values; repeated CDCServlet requests from the same user session to varying redirect targets.
• Application: Authentication events followed by session usage from geographically or behaviorally anomalous IP addresses, suggesting session token reuse by a different actor.

The primary remediation is to upgrade OpenAM Community Edition to version 16.1.1, which patches the CDCServlet to prevent session tokens from being sent to attacker-controlled URLs (GitHub Advisory). Organizations that cannot immediately upgrade should review and apply the non-default protective configuration referenced in the advisory, which can gate exploitation. Additionally, restricting or disabling CDSSO if it is not required for business operations will eliminate the attack surface entirely. Network-level controls such as egress filtering and allowlisting of permitted redirect domains can serve as compensating controls.