Maven/org.openidentityplatform.openam:openam-federation CVE-2026-45049: high 8.3, EPSS 0.33%

OpenAM Unauthenticated Session Hijacking via Information Exposure in CDCServlet

Action: Upgrade org.openidentityplatform.openam:openam-federation to 16.1.1 or later.

Affected

Fixed versions

Sources

• osv: GHSA-r9pv-5rpp-vm8g
• https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-r9pv-5rpp-vm8g
• https://github.com/OpenIdentityPlatform/OpenAM
• https://github.com/OpenIdentityPlatform/OpenAM/commit/bda647f8540d8fb28aaaed716914692678c5a0a7
• https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1

CVE-2026-45049 · published 2026-06-23T17:33:14Z · modified 2026-10-28T15:45:11.004943239Z · JSON