PT-2026-51615 · Unknown · Openkm Community Edition

Published 2026-06-23 · Updated 2026-06-23 · CVE-2026-45049

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenAM Community Edition versions prior to 16.1.1

Description An information exposure issue in the Cross-Domain Single Sign-On (CDSSO) servlet allows a logged-in user's raw session token to be sent via a POST request to an attacker-controlled URL. An attacker can induce an authenticated victim to visit a crafted URL to obtain the session credential, potentially leading to session hijacking. This issue specifically affects deployments where the CDSSO component is enabled, which is common in multi-domain environments.

Recommendations Update to version 16.1.1.

Fix

Weakness Enumeration

CWE-201

Related Identifiers

CVE-2026-45049

GHSA-R9PV-5RPP-VM8G

Affected Products

Openkm Community Edition

References · 4

• https://osv.dev/vulnerability/GHSA-r9pv-5rpp-vm8g · Vendor Advisory
• https://github.com/OpenIdentityPlatform/OpenAM · Note
• https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-r9pv-5rpp-vm8g · Note
• https://twitter.com/dailycve/status/2069499552848035880 · Twitter Post