> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# OpenAM Insecure SSO Cookie Initialization
- URL: https://f4n6.co.uk/security-feed/openam-insecure-sso-cookie-initialization/
- Published: 2026-08-16T14:53:04.000Z
- Updated: 2026-08-16T14:53:04.000Z
- Author: Jeff Davies
- Tags: #security-feed

## 1\. Executive summary

CVE-2026-53660 affects OpenAM Community Edition through version 16.0.6, shipping the `iPlanetDirectoryPro` SSO cookie with `HttpOnly=false` and no `SameSite` default in the default configuration. The cookie is reused as a CSRF token in OAuth/OIDC consent flows, meaning any same-origin XSS in the OpenAM origin can both steal the SSO session and complete attacker-driven OAuth consent grants in a single user click. No CISA KEV exploitation data or CVSS score was resolved for this item; severity is unconfirmed. EMEA financial services running OpenAM CE as an identity provider face direct risk of SSO session hijack and OAuth consent abuse if any XSS vulnerability exists in the same origin.

## 2\. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The vulnerability is a default-configuration weakness in a product that may be self-hosted or third-party-provided; without confirmation of exploitation or third-party service dependency, the distinctive-trigger test is not met for any article in the regulatory reference.

## 3\. Technical analysis & attack chain

**Vulnerability:** CWE-1189 (Insecure Default Initialization of Resource) in OpenAM Community Edition default configuration. Affects versions through 16.0.6\. Patched in version 16.1.1.

**Root cause:** The `iPlanetDirectoryPro` SSO cookie is initialised in the default OpenAM configuration with `HttpOnly=false`. Additionally, the cookie lacks a `SameSite` default attribute. The `iPlanetDirectoryPro` cookie is simultaneously used as a CSRF token in OAuth/OIDC consent flows.

### Attack chain (confirmed from advisory)

1. An authenticated OpenAM console user visits an attacker-controlled link or a page containing an attacker payload that triggers a same-origin XSS within the OpenAM origin. Any XSS in the OpenAM origin suffices; the vulnerability does not itself introduce XSS but amplifies its impact.
2. Because `HttpOnly=false`, JavaScript executed via the XSS can read the `iPlanetDirectoryPro` cookie value directly via `document.cookie`, yielding full SSO session theft.
3. Because the `iPlanetDirectoryPro` cookie is reused as the CSRF token in the OAuth/OIDC consent flow, the same XSS can simultaneously submit attacker-driven consent grants — the attacker obtains both the session and OAuth authorisation in one step.
4. The missing `SameSite` default widens the CSRF surface independently of XSS, enabling cross-site requests that carry the SSO cookie.

### Key technical details

- **Affected component:** OpenAM Community Edition, default configuration
- **Cookie:** `iPlanetDirectoryPro`
- **Insecure attributes:** `HttpOnly=false`, no `SameSite` default
- **Dual use:** SSO session token + CSRF token in OAuth/OIDC consent flows
- **Affected versions:** OpenAM Community Edition ≤ 16.0.6
- **Patched version:** 16.1.1
- **Prerequisite for session theft:** A same-origin XSS in the OpenAM origin must exist or be introduced; this vulnerability amplifies rather than creates the XSS vector
- **No CVE CVSS score, CISA KEV status, or EPSS data was resolved** for this item. Severity and exploitation status are unconfirmed.

**Confidence caveat:** All technical detail is single-sourced from the GitHub Advisory Database entry for CVE-2026-53660\. No independent corroboration, vendor advisory, or exploit proof-of-concept was available at time of writing. Verify before enforcement.

## 4\. Mitigation & containment

### P1 — Within 24 hours

- Identify all OpenAM Community Edition deployments in the estate. Confirm version. Any deployment ≤ 16.0.6 is affected.
- If upgrade to 16.1.1 is immediately feasible, apply it now. This is the vendor-provided fix.
- If upgrade cannot be completed within 24 hours, apply the following interim configuration hardening on the reverse proxy or load balancer in front of OpenAM:
- Override the `Set-Cookie` header for `iPlanetDirectoryPro` to include `HttpOnly` and `SameSite=Lax` (or `SameSite=Strict` if cross-site navigation to OpenAM flows is not required). Example for Apache mod\_headers: `Header edit Set-Cookie ^(iPlanetDirectoryPro=.*)$ "$1; HttpOnly; SameSite=Lax"`
- Example for Nginx using `proxy_cookie_flags` (Nginx ≥ 1.19.3): `proxy_cookie_flags iPlanetDirectoryPro httponly samesite=lax;`

### P2 — Within 72 hours

- Audit the OpenAM origin for any known or suspected XSS vulnerabilities. Because this flaw requires XSS to achieve session theft, eliminating XSS in the OpenAM origin breaks the attack chain even before the cookie attribute fix is applied.
- Review OAuth/OIDC consent grant logs for anomalous or bulk consent grants that may indicate prior abuse of the CSRF-token reuse weakness.
- If OpenAM is exposed to untrusted networks, restrict access to administrative consoles via network-level controls (IP allowlisting, VPN).

### P3 — Within 7 days

- Complete upgrade of all OpenAM Community Edition instances to version 16.1.1 across all environments (production, DR, non-prod).
- Validate post-upgrade that `iPlanetDirectoryPro` cookies are issued with `HttpOnly` and an appropriate `SameSite` attribute by inspecting `Set-Cookie` headers in browser dev tools or via curl.
- Assess whether the CSRF-token reuse pattern (SSO cookie doubling as CSRF token) persists in 16.1.1 or has been architecturally separated. If reuse persists, treat any future XSS in the OpenAM origin as critical regardless of the `HttpOnly` fix.
- If OpenAM is provided as a managed service by a third party, confirm the provider's patch status and cookie configuration in writing.

## 5\. Indicators of compromise

No indicators of compromise available in the source material.

### Behavioural indicators

| Behaviour                                                                                  | Where to observe                                      | Confidence                                                         |
| ------------------------------------------------------------------------------------------ | ----------------------------------------------------- | ------------------------------------------------------------------ |
| Anomalous OAuth/OIDC consent grants issued from existing authenticated sessions            | OpenAM audit logs, OAuth consent grant logs           | Medium — inferred from advisory impact description; single-sourced |
| iPlanetDirectoryPro cookie transmitted in cross-site requests without SameSite restriction | Browser DevTools, network proxy logs, WAF             | High — confirmed default configuration weakness                    |
| Set-Cookie header for iPlanetDirectoryPro lacking HttpOnly attribute                       | HTTP response headers via curl, browser DevTools, WAF | High — confirmed default configuration weakness                    |

## 6\. Detection

Insufficient indicators to author detection rules. The source material describes a configuration weakness and its impact, not a threat artefact with distinctive strings, file paths, or command-line indicators. Detection should focus on configuration validation (checking `Set-Cookie` headers for `iPlanetDirectoryPro` attributes) and behavioural monitoring of OAuth consent grants as described in §5.

## 7\. Sources

- GitHub Advisory Database, "CVE-2026-53660 — OpenAM Insecure SSO Cookie Initialization," https://github.com/advisories/GHSA-fpmh-vx4h-xc33, published 2026-08-14.

## 8\. Adverse Trace position

Severity is unconfirmed — no CVSS score, CISA KEV entry, or EPSS data was resolved for CVE-2026-53660\. The vulnerability is nonetheless high-impact for EMEA financial services that use OpenAM Community Edition as an SSO or OAuth/OIDC identity provider: the combination of `HttpOnly=false` and CSRF-token reuse in consent flows means a single XSS in the OpenAM origin yields both session theft and attacker-driven consent grants. The attack requires a pre-existing or future XSS in the same origin, which limits immediate exploitability but creates a chained-risk profile that warrants urgent hardening. Clients should treat this as a P1 configuration hardening task (cookie attribute override) even if the 16.1.1 upgrade is deferred. Adverse Trace will monitor for independent corroboration, CVSS publication, KEV addition, and any proof-of-concept exploit material. This advisory is single-sourced; verify before enforcement.

---

[Read the original source →](https://github.com/advisories/GHSA-fpmh-vx4h-xc33?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*