CVE-2026-45049

The record

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`CDSSO`) servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. An attacker who induces an authenticated victim to visit a crafted URL can receive the session credential and potentially hijack the session. Deployments must have `CDSSO` enabled, as is common in multi-domain deployments, and exploitation is additionally gated on a non-default configuration being absent. This issue is fixed in version 16.1.1.

Affected packages

Related vulnerabilities

• CVE-2026-116861 Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions. CWE-201
• CVE-2026-115947 Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions. CWE-201
• CVE-2026-119564 Plausible Analytics Community Edition through 3.2.1 contains an information exposure… CWE-201
• CVE-2026-107268 Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor… CWE-201
• CVE-2026-48200 Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document… CWE-201
• CVE-2026-118083 Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions. CWE-201
• CVE-2026-114173 The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data… CWE-201
• CVE-2026-115591 Insertion of Sensitive Information Into Sent Data vulnerability in Supsystic Contact Form… CWE-201