Sensitive Cookie with Improper SameSite Attribute Affecting org.openidentityplatform.openam:openam-core package, versions [,16.1.1)

Affected versions of this package are vulnerable to Sensitive Cookie with Improper SameSite Attribute through the server default configuration and OAuth2/OIDC consent flow in serverdefaults.properties, ConsentRequiredResource, and CsrfProtection. An attacker can steal or abuse an authenticated console user’s session by exploiting a script-readable SSO cookie during same-origin XSS or by driving consent requests that rely on the cookie-derived CSRF value. The vulnerable code ships the session cookie with HttpOnly=false and reuses the iPlanetDirectoryPro token as the csrf value in OAuth/OIDC consent pages, so browser scripts can read the session identifier and the consent flow accepts it as the anti-CSRF token. This enables session theft and attacker-controlled OAuth consent grants, breaking the user’s OpenAM session and exposing account access and authorization decisions.

• GitHub Commit
• Maintainer's Advisory