OpenAM 16.1.2 Security Update: Fixes for RCE, SSRF, and LDAP Injection

OpenAM 16.1.2 Security Update Summary Vulnerability Overview This 16.1.2 release patches several security vulnerabilities, primarily involving: WebSocket Driver: Message corruption in protocol length headers (CVE-2026-54466) JS-YAML: Quadratic complexity DoS in merge key handling (CVE-2026-4982) Uninitialized Memory Disclosure: Multiple CVEs involving uninitialized memory disclosure and memory exhaustion DoS Open Redirect: Open redirect in SAML 2.0/IDF IDP discovery (CVE-2026-61787) Groovy Script Sandbox Escape: Authentication RCE (CVE-2026-62261) ObjectInputStream Depth: Weak Java deserialization RCE (CVE-2026-62263) Reflected XSS: Via consent page in OAuth2/OIDC (CVE-2026-62289) Unauthenticated Remote Code Execution: Multiple endpoints (CVE-2026-63437, 63438, 63487, 63488) SSRF: OIDC dynamic client registration (CVE-2026-63485) LDAP Injection: Pre-authentication LDAP injection (CVE-2026-63487) XACML Policy Import: Remote Code Execution (CVE-2026-63488) REST API: LDAP injection in pre-authenticated REST API (CVE-2026-63487) OpenID Connect Endpoints: Revocation endpoint (CVE-2026-63484) Affected Components Primary Affected Components: WebSocket Driver, JS-YAML, SAML 2.0/IDF IDP, Groovy script sandbox, OAuth2/OIDC, OIDC dynamic client registration, XACML policy import, LDAP injection, REST API, OpenID Connect endpoints Affected Versions: Versions prior to 16.1.2 Remediation Upgrade to version 16.1.2 All listed CVE vulnerabilities above have been fixed A new revocation endpoint was added to support OpenID Connect discovery documents Updated OpenJDK 11 and 17. The OpenJDK 17. The OpenJDK 17. The OpenJDK 17. The OpenJDK 17. The OpenJDK 17. The OpenJDK 17. The OpenJDK 17. The OpenJDK 17. The OpenJDK 17. The OpenJDK 17. The OpenJDK 17. The OpenJDK 17. The OpenJDK 17. The OpenJDK 17. The OpenJDK 17. The OpenJDK 17. The OpenJDK 17. The OpenJDK 17. The OpenJDK 17. The OpenJDK 17. The OpenJDK 17. The OpenJDK 17

Goal Reached Thanks to every supporter — we hit 100%!

OpenAM 16.1.2 Security Update: Fixes for RCE, SSRF, and LDAP Injection

More from this source