CVE-2026-45049

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the "Cross-Domain Single Sign-On" "CDSSO" servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. An attacker who induces an authenticated victim to visit a crafted URL...

Sensitive Information Disclosure

OpenAM is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper handling of session tokens in the Cross-Domain Single Sign-On CDSSO servlet, which allows an attacker to trick a logged-in user into visiting a crafted URL and capture the user's raw session token,...