HIGH: org.openidentityplatform.openam:openam-core — OpenAM Insecure SSO Cookie Initialization
Summary Description An Insecure Default Initialization of Resource (CWE-1188) issue in the OpenAM default configuration ships the iPlanetDirectoryPro SSO cookie with HttpOnly=false. Also, the iPlanetDirectoryPro SSO cookie is used as a CSRF token in…
Source org.openidentityplatform.openam:openam-corePublished 17h ago · Aug 14, 2026Posted on Bluesky
What we hold
- Package
- org.openidentityplatform.openam:openam-core
- Ecosystem
- maven
- Severity
- HIGH
- ID
- CVE-2026-53660
Summary Description An Insecure Default Initialization of Resource (CWE-1188) issue in the OpenAM default configuration ships the iPlanetDirectoryPro SSO cookie with HttpOnly=false. Also, the iPlanetDirectoryPro SSO cookie is used as a CSRF token in…
Learning about advisories like this one the day they are published is a separate problem from reading them here. Dependabot alerts, the GitHub Advisory Database API, OSV.dev and npm audit, compared against live responses: how to get an alert when a dependency has a new security advisory.
More like this
HIGH: ansible-jailexec — Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)
Through version 1.3.0, the jailexec connection plugin's putfile resolved a transfer's destination to a path on the jail host ( + ) and ran mkdir -p and mv there as root on the host. Those commands follow symbolic links, and the path was operated on outside…
CRITICAL: codeigniter4/framework — CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules
Impact This is an unsafe file upload validation vulnerability that can lead to remote code execution in vulnerable application configurations. Applications are impacted when they: - validate uploads using isimage or mimein without an independent safe…
CRITICAL: crypto-js — crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain
Summary CryptoJS.lib.WordArray.random() in affected versions is not a cryptographically secure random number generator. Nominal requests for 128 or 256 bits of entropy produce effective search spaces of approximately 2^39 and 2^47 possibilities — small…