SZB-4c5df2cd92
CVE-2026-45049 disclosed in OpenAM CDSSO session token handling (CVSS 8.3)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- OpenAM
- Product
- OpenAM
- First seen
Summary
A Mastodon post citing TheHackerWire reports that OpenAM versions before 16.1.1 let the CDSSO servlet POST a logged-in user's raw session token to an attacker-controlled URL. The post rates the issue High at 8.3, and the excerpt is truncated, so the full attack conditions are not stated.
If you use OpenAM
Upgrade OpenAM to version 16.1.1 or later.
Review whether CDSSO is enabled in your deployment.
Check the vendor advisory for exposure and session invalidation guidance.
What the sources say 1
· Mastodon: “Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`CDSSO`) servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL.” Source