CVE-2026-53660 OpenIdentityPlatform CVE debrief

Who should care

Defenders responsible for OpenAM instances, especially those with versions prior to 16.1.1, should assess exposure and verify the feasibility of same-origin cross-site scripting in their environment. This includes administrators, security teams, and developers who manage or interact with OpenAM deployments.

Why it matters

CVE-2026-53660 is a high-severity vulnerability in OpenAM that allows session hijacking due to insecure cookie configuration. Defenders should prioritize verifying exposure, especially for versions prior to 16.1.1, and assess the feasibility of same-origin cross-site scripting. The vulnerability supports specific defensive consequences, including the need for secure cookie configuration and verification of instance version and configuration.

• Session hijacking through cookie theft
• Potential for unauthorized access to sensitive information
• Need for verification of OpenAM instance version and configuration
• Requirement for secure cookie configuration and SameSite protection

Technical summary

The vulnerability exists in Open Access Management (OpenAM) prior to version 16.1.1. The default configuration of the iPlanetDirectoryPro SSO cookie has HttpOnly disabled and lacks a protective SameSite default. This insecure configuration allows an attacker to read and reuse the cookie through same-origin cross-site scripting and an attacker-controlled link, enabling the theft of the SSO session and completion of attacker-driven consent grants.

Defensive priority

Defenders should prioritize verifying exposure of OpenAM instances, especially those with versions prior to 16.1.1, and assess the feasibility of same-origin cross-site scripting in their environment.

Recommended defensive actions

• Verify OpenAM instance version and configuration
• Assess environment for same-origin cross-site scripting feasibility
• Implement secure cookie configuration
• Upgrade to version 16.1.1 or later if vulnerable
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the corpus does not establish versions, exploitation, impact, or remediation beyond the provided information, which requires verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.