Is OmniDefend SSO Extension safe?

OmniDefend SSO Extension accepts forged postMessage tokens without origin validation, allowing any web page to read the Windows username when Windows autologin is configured.

The extension installs a message listener on every HTTP and HTTPS page that gates on a data-field token rather than the message origin. Any page can forge that token and send a request that causes the extension to query a native host for the current Windows username, which is then broadcast back via window.postMessage to all listeners on the page. The exposure occurs only when the Windows autologin feature is active in OmniDefend's server settings.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.