Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the default configuration initializes the iPlanetDirectoryPro SSO cookie with HttpOnly disabled and without a protective SameSite default, and OAuth and OpenID Connect consent flows reuse that cookie through CsrfProtection as a CSRF token. When combined with same-origin cross-site scripting and a user following an attacker-controlled link, the cookie can be read and reused to steal the SSO session and complete attacker-driven consent grants. This issue is fixed in version 16.1.1.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the default     configuration initializes the iPlanetDirectoryPro SSO cookie with HttpOnly disabled and without a     protective SameSite default, and OAuth and OpenID Connect consent flows reuse that cookie through     CsrfProtection as a CSRF token. When combined with same-origin cross-site scripting and a user following     an attacker-controlled link, the cookie can be read and reused to steal the SSO session and complete     attacker-driven consent grants. This issue is fixed in version 16.1.1. (CVE-2026-53660)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the default
    configuration initializes the iPlanetDirectoryPro SSO cookie with HttpOnly disabled and without a
    protective SameSite default, and OAuth and OpenID Connect consent flows reuse that cookie through
    CsrfProtection as a CSRF token. When combined with same-origin cross-site scripting and a user following
    an attacker-controlled link, the cookie can be read and reused to steal the SSO session and complete
    attacker-driven consent grants. This issue is fixed in version 16.1.1. (CVE-2026-53660)

ID	Name	Product	Family	Type	Severity
346415	Linux Distros Unpatched Vulnerability : CVE-2026-53660	Nessus	Misc.	Local	high
445985	SCA: security update for org.openidentityplatform.openam:openam-core (GHSA-fpmh-vx4h-xc33)	Tenable Cloud Security	SCA Checks	Local	high
445985	SCA: security update for org.openidentityplatform.openam:openam-core (GHSA-fpmh-vx4h-xc33)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-53660

high

Tenable Plugins

high

high

high