Share on:

OpenAM 16.1.2 Released

What’s new

Addressed third-party dependency vulnerabilities:
- CVE-2026-53550 - js-yaml quadratic-complexity DoS in merge key handling via repeated aliases
- CVE-2026-45736 - ws uninitialized memory disclosure
- CVE-2026-48779 - ws memory exhaustion DoS from tiny fragments and data chunks
- CVE-2026-54466 - websocket-driver message corruption via abuse of protocol length headers
- CVE-2026-54490 - websocket-driver resource limit bypass via message compression
Added revocation_endpoint to the OpenID Connect discovery document
Fixed NotCondition.equals reflexivity and enabled the OpenFM unit tests
Fixed non-resolvable parent POM for the openam-mcp-server module
Added the openam-samples modules to the main reactor
Removed the dead jwt-generator tool module and the obsolete openam-test integration test suite
Added CodeQL code scanning and enabled Javadoc doclint on JDK 11 and JDK 26
Updated embedded OpenDJ dependency to version 5.1.2

Full changeset (more details)