CVE-2026-53660: OpenAM Insecure SSO Cookie Initialization
(updated )
Description
An Insecure Default Initialization of Resource (CWE-1188) issue in the OpenAM default configuration ships the iPlanetDirectoryPro SSO cookie with HttpOnly=false. Also, the iPlanetDirectoryPro SSO cookie is used as a CSRF token in OAuth/OIDC flows. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1.
References
- github.com/OpenIdentityPlatform/OpenAM/commit/2af597267e6eb9302f75445c2c726f9b84f62966
- github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1
- github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-fpmh-vx4h-xc33
- github.com/advisories/GHSA-fpmh-vx4h-xc33
- nvd.nist.gov/vuln/detail/CVE-2026-53660
Code Behaviors & Features
Detect and mitigate CVE-2026-53660 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →