Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, identified as CVE-2026-45049, is an information exposure issue within the Cross-Domain Single Sign-On (CDSSO) functionality of OpenAM, specifically related to the CDCServlet. By analyzing the provided patch in commit bda647f8540d8fb28aaaed716914692678c5a0a7, the vulnerable function was identified as org.forgerock.openam.agent.TokenRestrictionResolver.resolve.
The vulnerability stemmed from improper validation of the gotoUrl parameter. The original code would first check a boolean flag, uniqueSSOTokenCookie. If this flag was false, the function would immediately return a NoOpTokenRestriction without validating the gotoUrl. The calling component, likely the CDCServlet, would then proceed to POST sensitive information, including the user's session token, to this unvalidated gotoUrl. An attacker could exploit this by crafting a malicious URL that, when visited by an authenticated user, would hijack their session.
The patch addresses this by reordering the logic. It ensures that the gotoUrl is always validated against a list of allowed URLs for the agent before checking the uniqueSSOTokenCookie flag. This change guarantees that the session token is only sent to trusted domains, mitigating the information exposure vulnerability.
org.forgerock.openam.agent.TokenRestrictionResolver.resolveopenam-core/src/main/java/org/forgerock/openam/agent/TokenRestrictionResolver.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.openidentityplatform.openam:openam-federation | maven | <= 16.0.6 | 16.1.1 |