CVE-2026-53660

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53660
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53660.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-53660
Aliases
Downstream
Published
2026-09-15T09:45:01Z
Modified
2026-09-17T08:05:16Z
Severity
  • 7.4 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenAM Insecure SSO Cookie Initialization
Details

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the default configuration initializes the iPlanetDirectoryPro SSO cookie with HttpOnly disabled and without a protective SameSite default, and OAuth and OpenID Connect consent flows reuse that cookie through CsrfProtection as a CSRF token. When combined with same-origin cross-site scripting and a user following an attacker-controlled link, the cookie can be read and reused to steal the SSO session and complete attacker-driven consent grants. This issue is fixed in version 16.1.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1004",
        "CWE-1188",
        "CWE-1275"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53660.json"
}
References

Affected packages

Git / github.com/openidentityplatform/openam

Affected ranges

Type
GIT
Repo
https://github.com/openidentityplatform/openam
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2af597267e6eb9302f75445c2c726f9b84f62966
Fixed
fe2271ec119e827b4252cec20293480322a84789
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "16.1.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

13.*
13.0.0
13.0.0-RC1
13.0.0-RC10
13.0.0-RC2
13.0.0-RC3
13.0.0-RC4
13.0.0-RC5
13.0.0-RC6
13.0.0-RC7
13.0.0-RC8
13.0.0-RC9
14.*
14.0.0
14.0.1
14.0.2
14.0.3
14.0.4
14.0.5
14.0.6
14.1.1
14.1.10
14.1.11
14.1.12
14.1.13
14.1.16
14.1.17
14.1.2
14.1.3
14.1.4
14.1.5
14.1.6
14.1.7
14.1.8
14.1.9
14.2.1
14.2.2
14.3.1
14.4.1
14.4.2
14.5.1
14.5.2
14.5.3
14.5.4
14.6.2
14.6.3
14.6.4
14.6.5
14.6.6
14.7.0
14.7.1
14.7.2
14.7.3
14.7.4
14.8.1
14.8.2
14.8.3
14.8.4
15.*
15.0.0
15.0.1
15.0.2
15.0.3
15.0.4
15.1.0
15.1.1
15.1.2
15.1.3
15.1.4
15.1.5
15.1.6
15.2.0
15.2.1
15.2.2
16.*
16.0.3
16.0.4
16.0.5
16.0.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53660.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "5405360505958099491767459918763571433",
                "59430780643808153572853563199112199249",
                "96994992697435002980468756676682877539",
                "36325704317983833101645042050892642020",
                "81668627539269926185313668324987868797",
                "48832313066470168150331654112605066890",
                "22798899801730273476442944076295137334"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53660-0daf8879",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openidentityplatform/openam/commit/2af597267e6eb9302f75445c2c726f9b84f62966",
        "target": {
            "file": "openam-core/src/main/java/com/sun/identity/setup/ServicesDefaultValues.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "52305462381668883006824888177940003598",
            "length": 361
        },
        "id": "CVE-2026-53660-0ea6500d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openidentityplatform/openam/commit/2af597267e6eb9302f75445c2c726f9b84f62966",
        "target": {
            "file": "openam-oauth2/src/main/java/org/forgerock/oauth2/restlet/AuthorizeResource.java",
            "function": "AuthorizeResource"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "177921207601881695913823330482845003881",
            "length": 4261
        },
        "id": "CVE-2026-53660-32db6240",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openidentityplatform/openam/commit/2af597267e6eb9302f75445c2c726f9b84f62966",
        "target": {
            "file": "openam-core/src/main/java/com/sun/identity/setup/ServicesDefaultValues.java",
            "function": "setServiceConfigValues"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "101166373867523827489137630083285271079",
            "length": 845
        },
        "id": "CVE-2026-53660-479841ae",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openidentityplatform/openam/commit/2af597267e6eb9302f75445c2c726f9b84f62966",
        "target": {
            "file": "openam-oauth2/src/test/java/org/forgerock/oauth2/restlet/AuthorizeResourceTest.java",
            "function": "setup"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "161607753527478622312659852509809838915",
                "46612706239118215957614869596708562624",
                "140107749659557699160770951588400594583",
                "276863134112717296007334611397630760450"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53660-5a5237e5",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openidentityplatform/openam/commit/2af597267e6eb9302f75445c2c726f9b84f62966",
        "target": {
            "file": "openam-core/src/main/java/com/sun/identity/setup/SetupConstants.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "111170502149403827544730924961227387331",
                "83046033417576906268405147575821932616",
                "326528108487792527496447958379640919677",
                "35362833582338449033331444698611209937",
                "250762050180310754608159752014122959426",
                "13437456559270061451668594530279895798",
                "223644142079745239509661309723632444174",
                "96744002091842121339710203926325539980",
                "300667214244814787044225159813029668771",
                "335145505935947530903146685053614947863",
                "10486296402692833835849219749387140159",
                "10600464774569898992377194676505666609",
                "80208048263829950507886574888038475182",
                "28827892357475801275213838230437439087",
                "292025746695794171460239030421213502459"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53660-a7217798",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openidentityplatform/openam/commit/2af597267e6eb9302f75445c2c726f9b84f62966",
        "target": {
            "file": "openam-oauth2/src/main/java/org/forgerock/oauth2/core/CsrfProtection.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "314558146896129794203157062011118922847",
                "169207548133588793282810914677482437891",
                "293794097207546870717282886156848775031",
                "65211643424013413664288748621669979514",
                "20131720631192464418655993718389544785",
                "159600688369921733850334970632132990251",
                "73082612164130437713426395761929656351",
                "246841891989886711502361039966558441386",
                "289879885673616672847042551435349680977",
                "59492727662192167253924237740898355330"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53660-a9755013",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openidentityplatform/openam/commit/2af597267e6eb9302f75445c2c726f9b84f62966",
        "target": {
            "file": "openam-oauth2/src/main/java/org/forgerock/oauth2/restlet/AuthorizeResource.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "182392814473158680630614160624465925967",
            "length": 157
        },
        "id": "CVE-2026-53660-aad26d90",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openidentityplatform/openam/commit/2af597267e6eb9302f75445c2c726f9b84f62966",
        "target": {
            "file": "openam-oauth2/src/main/java/org/forgerock/oauth2/restlet/ConsentRequiredResource.java",
            "function": "ConsentRequiredResource"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "205385459146534400055517401876583699112",
                "15987667742561574185881981202248901414",
                "201822732293840560851867129382658762947",
                "195869358348772841553046424668145384092",
                "336787292180262506723797991776845533824"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53660-c446e790",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openidentityplatform/openam/commit/2af597267e6eb9302f75445c2c726f9b84f62966",
        "target": {
            "file": "openam-oauth2/src/main/java/org/forgerock/oauth2/restlet/DeviceCodeVerificationResource.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "112164618562627641952915093961676076090",
                "146004035011025513551483829973518804807",
                "183405863849582906116438956970103118058",
                "154876791312603174378546247741933690217",
                "88572271035164225185210345763488428510",
                "101116442942484378159216779110237413580",
                "36582622393946366980698423018492553026",
                "293197666289563780146828697420500361709",
                "75321007999449888979773830307144137215",
                "216810273469790762302792711325715633733",
                "329001732268994462781628592313042473319",
                "11942061635669436930717084140952079600",
                "16566124900888561061284381044447361096",
                "98803429818150195549044753865995116528",
                "23467702434583636161870541937361163618",
                "78509431963108236794489378055750449446",
                "160888137555757395521000580355773128243",
                "171404828137363043948394885716397881977",
                "79702966762822310150149892727013467496",
                "60754556895013998574215328659647856136",
                "179861518703507197131580957588899010139",
                "284762687045093227207753228308052856211",
                "19472839512345349923570506993108839342",
                "72608646953708919452741558088145853843",
                "174931866283244105193288106981783793253",
                "263753449273741356396802309822000541096"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53660-c80b8a00",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openidentityplatform/openam/commit/2af597267e6eb9302f75445c2c726f9b84f62966",
        "target": {
            "file": "openam-oauth2/src/main/java/org/forgerock/oauth2/restlet/ConsentRequiredResource.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "31580413592299520591211139553300975763",
            "length": 312
        },
        "id": "CVE-2026-53660-e2fe6dac",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openidentityplatform/openam/commit/2af597267e6eb9302f75445c2c726f9b84f62966",
        "target": {
            "file": "openam-oauth2/src/main/java/org/forgerock/oauth2/core/CsrfProtection.java",
            "function": "isCsrfAttack"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "91881241261352058440677922282958696658",
                "10395695171365765368577047897438930982",
                "329170668841352756549981169691297357956",
                "65211643424013413664288748621669979514",
                "20131720631192464418655993718389544785",
                "241218046422324694750214886990469913166",
                "77692966979795149414846633578171978471",
                "110408247826225311864048587521469889059",
                "5316055233513887164559892964054872113",
                "291058192965322810358158045199756057656",
                "304329589999913736662454090716369616815",
                "295172542520699205434946957696354266581",
                "74256684672445795707584445804204506946"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53660-ea3e5495",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openidentityplatform/openam/commit/2af597267e6eb9302f75445c2c726f9b84f62966",
        "target": {
            "file": "openam-oauth2/src/test/java/org/forgerock/oauth2/restlet/AuthorizeResourceTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "221194417822557354311226981168175161434",
            "length": 495
        },
        "id": "CVE-2026-53660-f48906fd",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openidentityplatform/openam/commit/2af597267e6eb9302f75445c2c726f9b84f62966",
        "target": {
            "file": "openam-oauth2/src/main/java/org/forgerock/oauth2/restlet/DeviceCodeVerificationResource.java",
            "function": "DeviceCodeVerificationResource"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "315631124736913199098387421731790226475",
            "length": 1488
        },
        "id": "CVE-2026-53660-fe09bb4b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openidentityplatform/openam/commit/2af597267e6eb9302f75445c2c726f9b84f62966",
        "target": {
            "file": "openam-oauth2/src/main/java/org/forgerock/oauth2/restlet/ConsentRequiredResource.java",
            "function": "getDataModel"
        }
    }
]
vanir_signatures_modified 
"2026-09-17T08:05:16Z"