How severe is CVE-2026-45049?

CVE-2026-45049 has a CVSS score of 8.3/10, rated HIGH. Immediate patching is strongly recommended.

Which packages are affected by CVE-2026-45049?

CVE-2026-45049 affects the following packages: org.openidentityplatform.openam:openam-federation (Maven). Ecosystems affected: Maven.

How do I fix CVE-2026-45049?

Update org.openidentityplatform.openam:openam-federation to 16.1.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-45049 is resolved across your whole dependency graph.

How do I detect CVE-2026-45049 in my Maven dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.openidentityplatform.openam:openam-federation, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2026-45049 if there is no patch (or I can't update yet)?

Assume what was exposed is already known: rotate any credential, token or key that the affected component could return, restrict the endpoint to callers that genuinely need it, and strip sensitive fields from responses and error output at the boundary rather than relying on the client not to read them.

Is CVE-2026-45049 actively exploited in the wild?

No public exploit code has been indexed for CVE-2026-45049 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was CVE-2026-45049 published, and has it been updated?

CVE-2026-45049 was published on June 23, 2026 and was last updated on June 23, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

☕

☕ Maven

Not in CISA KEV

HIGH severity

CVE-2026-45049 — openam-federation

HIGH

CVE-2026-45049 is a high-severity (CVSS 8.3) vulnerability in org.openidentityplatform.openam:openam-federation. A fix is available for org.openidentityplatform.openam:openam-federation — see the affected versions and patch details below.

OpenAM Unauthenticated Session Hijacking via Information Exposure in CDCServlet

Published

Jun 23, 2026

Updated

Jun 23, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Jun 23, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

☕org.openidentityplatform.openam:openam-federation

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Summary

Description

An Information Exposure Through Sent Data (CWE-201) issue in OpenAM's Cross-Domain Single Sign-On (CDSSO) servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. This impacts OpenAM Community Edition through version 16.0.6. This issue was patched in version 16.1.1.

An attacker who can induce a logged-in victim to visit a crafted URL may receive the victim's session credential, which could enable session hijacking.

Impact

OpenAM deployments through version 16.0.6 that have CDSSO enabled are potentially affected. The CDSSO component is commonly enabled in multi-domain deployments. Exploitation requires user interaction — an authenticated user must be induced to visit an attacker-crafted URL — and is further gated on a non-default configuration being absent.

Patch

This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
☕Maven	`org.openidentityplatform.openam:openam-federation`	all versions	16.1.1`org.openidentityplatform.openam:openam-federation:16.1.1`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.openidentityplatform.openam:openam-federation, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update org.openidentityplatform.openam:openam-federation to 16.1.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-45049 is resolved across your whole dependency graph.
Workarounds
Assume what was exposed is already known: rotate any credential, token or key that the affected component could return, restrict the endpoint to callers that genuinely need it, and strip sensitive fields from responses and error output at the boundary rather than relying on the client not to read them.

Frequently Asked Questions

## Summary **Description** An Information Exposure Through Sent Data (CWE-201) issue in OpenAM's Cross-Domain Single Sign-On (CDSSO) servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. This impacts OpenAM Community Edition through version 16.0.6. This issue was patched in version 16.1.1. An attacker who can induce a logged-in victim to visit a crafted URL may receive the victim's session credential, which could enable session hijacking. ## Impact OpenAM deployments through version 16.0.6 that have CDSSO enabled are potentially affected. Th

O3 Security · Impact-Aware SCA

Is CVE-2026-45049 in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works