OpenAM 16.1.3 Released

Download

What’s new

Security vulnerabilities - OpenAM

• Addressed OpenAM security vulnerabilities:
  • GHSA-qcqm-7432-wg7r - Unauthenticated federation-management operations via Liberty ID-FF endpoints
  • GHSA-wxmx-q96f-w4gw - Unauthenticated arbitrary class instantiation via the legacy JAX-RPC remote SDK interface
  • GHSA-6jpj-522x-53vv - Arbitrary class loading and instantiation via the entitlement applications REST endpoint
  • GHSA-573r-mwh6-jw8j - Arbitrary class loading and instantiation via policy import (incomplete fix for CVE-2026-63468)
  • GHSA-xq25-2x9w-94w9 - Incomplete SSRF protection for server-fetched URLs (bypass of the CVE-2026-63467 and CVE-2026-63484 fixes)
  • GHSA-g7cv-hh35-cc7c - SSRF and unbounded server-side fetch via the OpenID Connect client jwks_uri
  • GHSA-5p2f-7vcr-6vfh - PKCE enforcement does not cover OAuth 2.0 hybrid flows (residual of CVE-2026-48717)
  • GHSA-6f8c-crwq-jqm3 - End-session endpoint accepts an unverified id_token_hint, enabling redirects to any client’s registered post-logout URI
  • GHSA-3m32-w9x3-vvq8 - Reflected XSS on the OAuth2 authorization error page
  • GHSA-hmwh-9r8r-44gw - Delegated session-destroy privilege is not scoped to the realm of the session being destroyed
  • GHSA-x8cj-3hqv-cgwh - Session query REST endpoint lets a realm administrator list the sessions of every realm
  • GHSA-mw38-8gr7-c4x2 - Anonymous forgot-password and self-registration REST actions send attacker-worded email from the server’s own address
  • GHSA-v796-mg6j-9c5m - Unencoded values in the SAML auto-submit page of the load-balancer cookie bounce (not reachable in released versions)

Security hardening

• Hardened AuthXMLRequest.setPrincipal against arbitrary class instantiation (same pattern as CVE-2026-62379)
• Client assertions are verified by their own signing algorithm; id_token_signed_response_alg now has a default value
• Validated ID-FF forward targets, FilesRepo identity names and the SAML1 POST target
• Session ids, access tokens and password attributes are no longer written to logs
• Escaped reflected request parameters in the sample servlets
• SetupUtils passes chmod arguments to Runtime.exec as an array

Security vulnerabilities - dependencies

• Addressed third-party dependency vulnerabilities:
  • CVE-2026-71497 - jsoup Cleaner may expose markup with custom raw-text elements
  • CVE-2026-43871 - Apache Thrift infinite loop in the Java bindings
  • CVE-2026-59949 - lz4-java native XXHash implementations can crash the JVM on invalid byte array ranges
  • CVE-2026-13149, CVE-2026-33750, CVE-2026-45149, CVE-2026-14257, CVE-2026-69152 - brace-expansion DoS via unbounded expansion
  • CVE-2026-59869, CVE-2026-84375, GHSA-5p4m-2wfm-xmqj - js-yaml quadratic CPU consumption in merge key and !!omap handling
  • CVE-2026-13676, CVE-2026-16221, CVE-2026-18446, CVE-2026-75899, CVE-2026-75931, CVE-2026-75975, CVE-2026-76172, CVE-2026-84292, CVE-2026-84394 - fast-uri host confusion and SSRF
  • CVE-2026-53666, CVE-2026-53669, GHSA-qwww-vcr4-c8h2 - React Router constructor injection, open redirect and RSC mode CSRF bypass
  • CVE-2026-69185, CVE-2026-33151 - Socket.IO memory exhaustion via binary attachments
  • CVE-2026-59879 - Immutable.js List 32-bit trie overflow DoS
  • CVE-2026-59887 - linkify-it quadratic-complexity DoS via the mailto: validator
  • CVE-2026-73646 - PostCSS path traversal in source map auto-loading
  • CVE-2026-73088, CVE-2026-73089 - Browserslist prototype write via untrusted custom stats and unbounded cache growth
  • CVE-2026-84373 - Vitest arbitrary file read via @vitest/mocker redirect mocks
  • GHSA-p498-v437-472g - humanfs recursive copy follows symlinks outside the source tree

Fixes

• OAuth2 consent accepts the resource owner’s session id as the CSRF value
• Added an upgrade step that syncs missing ScriptingService sub-configurations
• Click fork no longer calls the javax.servlet-bound upstream ClickUtils
• Fixed the precompile-jsps profile for the Jakarta EE 9 webapp
• Fixed contradicting documentation on XUI and HttpOnly session cookies

Full changeset (more details)

Thanks for the contributions

1. Valery Kharseko
2. Maxim Thomas
3. tsujiguchitky
4. Jace
5. Santh
6. Arpit Jain
7. Buggs777
8. rockymelody
9. Alex P
10. tonghuaroot
11. BarakSrour
12. Bishop
13. Ayham