OpenAM Community Edition through version 16.0.6 has an insecure default configuration where the iPlanetDirectoryPro SSO cookie is set with HttpOnly=false. This cookie is also used as a CSRF token in OAuth/OIDC flows. The vulnerability allows an attacker to steal the full SSO session of an authenticated console user by leveraging same-origin XSS vulnerabilities. The issue is patched in version 16.1.1.