Cross-Domain Single Sign-On Vulnerability in OpenAM Access Management Solution

CVE-2026-45049

What is CVE-2026-45049?

The Cross-Domain Single Sign-On functionality in OpenAM allows an attacker to exploit a flaw that permits the POSTing of a user's raw session token to a malicious URL. This vulnerability can lead to session hijacking when an authenticated user is tricked into navigating to a crafted link. The risk is particularly high in multi-domain configurations where CDSSO is enabled. The issue is mitigated by upgrading to version 16.1.1, which addresses this security threat.

References