OpenAM: Nine Vulnerabilities Including Critical Class Instantiation Flaw Disclosed Together
Nine vulnerabilities, including a critical arbitrary class instantiation flaw, were disclosed for OpenAM, impacting its authentication and authorization security.
Key findings
- Nine vulnerabilities disclosed for OpenAM on October 3, 2026, patched in version 16.1.3.
- High severity flaw (CVE-2026-105115) allows unauthenticated arbitrary class instantiation via JAX-RPC SOAP interface.
- Multiple authorization bypasses (CVE-2026-105121, CVE-2026-105120) and OAuth 2.0 flaws (CVE-2026-105119, CVE-2026-105118) were found.
- Other vulnerabilities include SSRF (CVE-2026-105122), email injection (CVE-2026-105117), and XSS (CVE-2026-105116, CVE-2026-105114).
- Users are urged to update to OpenAM 16.1.3 to address these security risks.
On October 3, 2026, a batch of nine vulnerabilities was disclosed for OpenAM, a product of Openidentityplatform. The vulnerabilities, all patched in version 16.1.3, range in severity from Medium to High, with one critical flaw allowing unauthenticated arbitrary class instantiation. This disclosure event highlights several security weaknesses within OpenAM's authentication and authorization flows, impacting its ability to securely manage user sessions and OAuth 2.0 clients.
Several vulnerabilities revolve around authorization flaws. CVE-2026-105121 and CVE-2026-105120 detail improper authorization issues where delegated administrators could destroy sessions outside their realms or list sessions across all realms, respectively. This bypass of realm checks could expose sensitive user information.
Security concerns also extend to OAuth 2.0 and OpenID Connect implementations. CVE-2026-105119 points to a bypass of OAuth2 Provider PKCE enforcement for hybrid flows, potentially allowing attackers to redeem intercepted codes for access tokens. Additionally, CVE-2026-105118 describes an open redirect vulnerability in the OAuth2 end session endpoint, which could be leveraged for phishing attacks by redirecting users to malicious post-logout URIs.
Further vulnerabilities include a server-side request forgery (SSRF) in CVE-2026-105122, enabling attackers to fetch internal resources by manipulating the jwks_uri. CVE-2026-105117 details an email content injection flaw, allowing attackers to craft phishing emails through the forgot password and registration functionalities. A latent cross-site scripting (XSS) vulnerability in CVE-2026-105116 could lead to script execution under certain conditions involving SAML messages. Lastly, CVE-2026-105114 presents a reflected XSS vulnerability on the OAuth2 authorization error page, exploitable by luring victims to crafted links.
The most severe vulnerability, CVE-2026-105115, is an unauthenticated arbitrary class instantiation flaw within the legacy JAX-RPC SOAP interface. This allows remote attackers to load arbitrary classes without authentication by sending specially crafted SOAP requests, potentially leading to remote code execution or denial-of-service conditions.
All nine vulnerabilities were addressed in OpenAM version 16.1.3. Users are strongly advised to update to this version to mitigate the risks associated with these security flaws. The consistent patching across multiple components indicates a focused effort by Openidentityplatform to rectify these issues.
This batch of vulnerabilities underscores the importance of regularly auditing and updating identity and access management solutions like OpenAM. The diverse nature of the flaws, from SSRF and XSS to authorization bypasses and class instantiation, highlights the complex attack surface of such systems and the need for continuous security vigilance. Users should prioritize patching and review their configurations for any signs of compromise.