high
CVE-2026-105115
OpenAM before 16.1.3: unauthenticated arbitrary class instantiation via the legacy JAX-RPC SOAP interface, plus cross-realm session disclosure/destruction, OAuth2 client SSRF, reflected and SAML-bounce XSS, email content injection and an id_token_hint open redirect
- Severity
- high
- Affected product
- OpenAM
- Affected versions
- OpenAM < 16.1.3
- Fixed in
- OpenAM 16.1.3
- Detection basis
- Component version range
- Shipped rule
- OpenAM: OpenAM before 16.1.3: unauthenticated arbitrary class instantiation via the legacy JAX-RPC SOAP interface, plus cross-realm session disclosure/destruction, OAuth2 client SSRF, reflected and SAML-bounce XSS, email content injection and an id_token_hint open redirect
- Added to NewScan
- 2026-10-04
- Detected by
- NewScan — free, self-hosted
How NewScan reports it
COMPONENT VERSION RANGE
NewScan fingerprints OpenAM from its response and reports this CVE when the detected version falls inside the affected range below.
Related CVEs covered by this detection
The same shipped rule and upgrade also cover these identifiers:
- CVE-2026-105114 ↗
- CVE-2026-105116 ↗
- CVE-2026-105117 ↗
- CVE-2026-105118 ↗
- CVE-2026-105120 ↗
- CVE-2026-105121 ↗
- CVE-2026-105122 ↗
References
Scan for this yourself — local, in-band scanning is free.
Get NewScan (FREE) →Review the measured benchmark, then use the verified remediation process.