{"affected":[{"product":"OpenAM","source":"CNA: GitHub_M","vendor":"OpenIdentityPlatform","versions":[{"status":"affected","version":"< 16.1.1"}]},{"defaultStatus":"unaffected","ecosystem":"Maven","packageName":"org.openidentityplatform.openam:openam-federation","product":"org.openidentityplatform.openam:openam-federation","source":"OSV GHSA-r9pv-5rpp-vm8g","vendor":"","versions":[{"status":"affected","version":"14.5.2","versionType":"Maven"},{"status":"affected","version":"14.5.3","versionType":"Maven"},{"status":"affected","version":"14.5.4","versionType":"Maven"},{"status":"affected","version":"14.6.1","versionType":"Maven"},{"status":"affected","version":"14.6.2","versionType":"Maven"},{"status":"affected","version":"14.6.3","versionType":"Maven"},{"status":"affected","version":"14.6.4","versionType":"Maven"},{"status":"affected","version":"14.6.5","versionType":"Maven"},{"status":"affected","version":"14.6.6","versionType":"Maven"},{"status":"affected","version":"14.7.0","versionType":"Maven"},{"status":"affected","version":"14.7.1","versionType":"Maven"},{"status":"affected","version":"14.7.2","versionType":"Maven"},{"status":"affected","version":"14.7.3","versionType":"Maven"},{"status":"affected","version":"14.7.4","versionType":"Maven"},{"status":"affected","version":"14.8.1","versionType":"Maven"},{"status":"affected","version":"14.8.2","versionType":"Maven"},{"status":"affected","version":"14.8.3","versionType":"Maven"},{"status":"affected","version":"14.8.4","versionType":"Maven"},{"status":"affected","version":"15.0.0","versionType":"Maven"},{"status":"affected","version":"15.0.1","versionType":"Maven"},{"status":"affected","version":"15.0.2","versionType":"Maven"},{"status":"affected","version":"15.0.3","versionType":"Maven"},{"status":"affected","version":"15.0.4","versionType":"Maven"},{"status":"affected","version":"15.1.0","versionType":"Maven"},{"status":"affected","version":"15.1.1","versionType":"Maven"},{"status":"affected","version":"15.1.2","versionType":"Maven"},{"status":"affected","version":"15.1.3","versionType":"Maven"},{"status":"affected","version":"15.1.4","versionType":"Maven"},{"status":"affected","version":"15.1.5","versionType":"Maven"},{"status":"affected","version":"15.1.6","versionType":"Maven"},{"status":"affected","version":"15.2.0","versionType":"Maven"},{"status":"affected","version":"15.2.1","versionType":"Maven"},{"status":"affected","version":"15.2.2","versionType":"Maven"},{"status":"affected","version":"16.0.1","versionType":"Maven"},{"status":"affected","version":"16.0.2","versionType":"Maven"},{"status":"affected","version":"16.0.3","versionType":"Maven"},{"status":"affected","version":"16.0.4","versionType":"Maven"},{"status":"affected","version":"16.0.5","versionType":"Maven"},{"status":"affected","version":"16.0.6","versionType":"Maven"},{"status":"affected","version":"16.1.0","versionType":"Maven"},{"events":[{"introduced":"0"},{"fixed":"16.1.1"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-45049","cwes":["CWE-201"],"description":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`CDSSO`) servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. An attacker who induces an authenticated victim to visit a crafted URL can receive the session credential and potentially hijack the session. Deployments must have `CDSSO` enabled, as is common in multi-domain deployments, and exploitation is additionally gated on a non-default configuration being absent. This issue is fixed in version 16.1.1.","epss":{"date":"2026-11-03","percentile":0.26453,"score":0.00332},"exploits":[],"kev":null,"metrics":[{"score":8.3,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793756945356,"publishedAt":1793308435740,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-r9pv-5rpp-vm8g"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/OpenIdentityPlatform/OpenAM/commit/bda647f8540d8fb28aaaed716914692678c5a0a7"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-r9pv-5rpp-vm8g"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-r9pv-5rpp-vm8g"}],"remediation":[{"kind":"fix","source":"OSV GHSA-r9pv-5rpp-vm8g","text":"org.openidentityplatform.openam:openam-federation (Maven): OSV reports a fixed version 16.1.1. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-r9pv-5rpp-vm8g"}],"revision":"e85285be1c2a0004c5eb963c1d97452a2ef3e0227cdc8427870495442ea54647","sources":[{"modifiedAt":1793756945356,"name":"CNA: GitHub_M","retrievedAt":1793758160030,"url":"https://www.cve.org/CVERecord?id=CVE-2026-45049"},{"modifiedAt":1793202311004,"name":"OSV / GitHub Security Advisories","retrievedAt":1793758161185,"url":"https://osv.dev/vulnerability/GHSA-r9pv-5rpp-vm8g"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793758169932,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-45049"}],"ssvc":{"assessedAt":1793756934246,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"OpenAM Session Hijacking via CDSSO","updatedAt":1793758169932}