16.1.4

What's Changed

• GHSA-hvfc-4v4r-8p9w built-in accounts with publicly known passwords (demo user, anonymous, WS-Security agents) allow unauthenticated login, thanks @FireBurn, @maximthomas, @tsujiguchitky ❤️
• GHSA-g5vw-v384-gw9v SSRF, credential leak and CRL store tampering via the CRL distribution point of a presented certificate, thanks @leanworld7-netizen, @tsujiguchitky, @vharseko ❤️
• GHSA-5c3q-hp86-xjr8 unauthenticated disclosure of live session tokens via the notification WebSocket, enabling session hijacking and administrative compromise, thanks @DauHoangTai, @tsujiguchitky, @vharseko ❤️
• GHSA-3j2f-qhrc-rjfj SAML v2.0 service provider accepts unsigned assertions on some bindings, allowing unauthenticated account takeover, thanks @rockmelodies, @maximthomas, @tsujiguchitky ❤️
• GHSA-jv8f-m88g-h6mm self-registration does not enforce the allowed attribute list, allowing an anonymous user to create an administrator account, thanks @santhreal, @jamesbishup, @maximthomas, @tsujiguchitky ❤️
• GHSA-mgwg-24cx-c8w3 open redirect from WS-Federation and SAML v2.0 pages that do not check the destination against the allowed list, thanks @santhreal, @maximthomas, @tsujiguchitky ❤️
• GHSA-fhqm-62hv-4phw open redirect via SAML v2.0 RelayState when no RelayState URL list is configured (the default), thanks @santhreal, @maximthomas, @tsujiguchitky ❤️
• GHSA-2gwf-vxp5-f9v2 open redirect after login via goto and gotoOnFail when Valid goto URL Resources is not configured (the default), thanks @santhreal, @maximthomas, @tsujiguchitky ❤️
• GHSA-545c-rm35-2jj2 cross-site request forgery in the OAuth 2.0 device flow lets a client obtain tokens for a logged-in user when consent is skipped, thanks @santhreal, @maximthomas, @tsujiguchitky ❤️
• GHSA-6gg2-2v5m-454x insufficient validation of responses on the internal server-to-server SOAP channel, thanks @manus-pi, @maximthomas, @tsujiguchitky ❤️
• GHSA-x7wr-5gxg-v833 unauthenticated denial of service through unbounded deserialisation on remote SDK and console endpoints, thanks @manus-pi, @maximthomas, @tsujiguchitky ❤️
• GHSA-h93p-35jm-rj83 PKCE is not enforced in the OAuth 2.0 device authorization flow, thanks @manus-pi, @maximthomas, @tsujiguchitky ❤️
• GHSA-rw43-r238-4c7j open redirect after SAML 1.x single sign-on through loose trusted-partner matching, thanks @qurb4n01, @maximthomas, @tsujiguchitky ❤️
• GHSA-pw99-8h4m-p3gm incomplete encoding of attribute values in the SAML 1.x service provider form POST, thanks @qurb4n01, @maximthomas, @tsujiguchitky ❤️
• GHSA-v6hq-3cfh-5gr6 stored cross-site scripting through the user display name on the OAuth 2.0 / OpenID Connect consent page, thanks @manus-pi, @maximthomas, @tsujiguchitky ❤️
• GHSA-j56q-q3r3-hg7f SAML 1.x signature verification does not bind the signer to the issuer, allowing one trusted partner to impersonate another, thanks @isazajuancarlos, @maximthomas, @tsujiguchitky ❤️
• GHSA-7q42-6xr7-9rmw server-side request forgery through UMA scope description URLs in pending-request notifications, thanks @manus-use, @maximthomas, @tsujiguchitky ❤️
• GHSA-rmw3-j353-w9f7 server-side request forgery through metadata URLs in the federation configuration wizards, thanks @manus-use, @maximthomas, @tsujiguchitky ❤️
• CVE-2026-84939 GHSA-27j2-h3m2-8237 freemarker: Path traversal in template loading via malformed locale (2.3.31 -> 2.3.35) by @dependabot[bot] in #1142
• Run the security filters on every dispatch type by @vharseko in #1133
• Check the SAML 1.x TARGET and the WS-Federation wreply against the realm's valid goto URLs by @vharseko in #1135
• Fix Device Code session propagation and OIDC claims by @dairoca90 in #1108
• Keep stack traces and exception messages out of HTTP responses by @vharseko in #1138
• Read SAML parameters from their binding in the .NET Fedlet; run e2e scripts without a shell by @vharseko in #1139
• Run the CodeQL security-and-quality suite by @vharseko in #1140
• Add Trivy vulnerability scanning for the Docker image by @vharseko in #1141
• Set the Secure and HttpOnly cookie flags from creation by @vharseko in #1136
• Keep a logged value from forging a debug record by @vharseko in #1137
• [#1143] Reject expired device codes at the token and verification endpoints by @vharseko in #1144
• Close the cheap CodeQL findings: pinned actions, token scopes, TLS identity, private temp files by @vharseko in #1134
• Bump the github-actions group with 4 updates by @dependabot[bot] in #1147
• Raise the RequireJS and Mocha timeouts of the UI unit tests by @vharseko in #1148
• [#1145] Keep the IdP discovery cookie within RFC 6265 by @vharseko in #1146
• CVE-2026-102276 CVE-2026-102277 CVE-2026-102278 brace-expansion: Stack-exhaustion and quadratic-time DoS in brace parsing (1.1.18 -> 1.1.21) by @dependabot[bot] in #1149
• GHSA-253c-mchw-3w2r GHSA-r7fv-28h4-cvq7 markdown-it: Quadratic-time DoS in linkify and smartquotes (14.2.0 -> 14.3.2) by @dependabot[bot] in #1151
• Tomcat 10.1.59: CVE-2026-41293 CVE-2026-43512 CVE-2026-43515 CVE-2026-65182 CVE-2026-65905 CVE-2026-68525 CVE-2026-24734 CVE-2026-24880 CVE-2026-34483 CVE-2026-34487 CVE-2026-41284 CVE-2026-42498 CVE-2026-43513 CVE-2025-66614 CVE-2026-25854 CVE-2026-43514 by @dependabot[bot] in #1150
• [#1154] Replace legacy ForgeRock relative links in the guides with Antora xrefs by @vharseko in #1158
• [#1155] Fix typos, unresolved placeholders and dead ForgeRock links in the guides by @vharseko in #1157
• Keep vendored and generated code out of CodeQL by @vharseko in #1152
• CVE-2026-102276 CVE-2026-102277 CVE-2026-102278 brace-expansion: Stack-exhaustion and quadratic-time DoS in brace parsing (5.0.9 -> 5.0.12) by @dependabot[bot] in #1159
• [#1160] [#1162] Allow unescaped '=' and non-leading '#' in LDAPUtils dnRule attribute values by @nicholascowan in #1161
• Remove duplicate testng dependency from openam-core POM by @vharseko in #1164
• Update Java version to 27 in build.yml by @vharseko in #1163
• Fix Maven Central release: pin Maven 3.9.16, bump central-publishing to 0.11.0 by @vharseko in #1165
• CVE-2026-106449 CVE-2026-106450 CVE-2026-106451 CVE-2026-106452 CVE-2026-106453 at.yawk.lz4:lz4-java: Decompression DoS and native-library hijack via shared tmpdir (1.11.1 -> 1.11.4) by @dependabot[bot] in #1166
• CVE-2026-102276 CVE-2026-102277 CVE-2026-102278 brace-expansion: Stack-exhaustion and quadratic-time DoS in brace parsing (1.1.18 -> 1.1.21) by @dependabot[bot] in #1167
• CVE-2026-93749 source-map-js: Event-loop DoS via unvalidated indexed source-map section offsets (1.2.1 -> 1.2.2) by @dependabot[bot] in #1168
• CVE-2026-75140 jsoup: Memory exhaustion in XmlTreeBuilder via deeply nested namespace declarations (1.23.1 -> 1.23.2) by @dependabot[bot] in #1169
• WindowsDesktopSSO (Kerberos/SPNEGO) tests without Windows: Playwright e2e and Kerby module test by @maximthomas in #1172
• Apply Ubuntu security updates when building the Docker image by @vharseko in #1178
• [#1170] WindowsDesktopSSO: complete /json/authenticate from a Negotiate header in one request by @maximthomas in #1177
• [#1173] WindowsDesktopSSO: succeed and cache the service login after a retry on expired credentials by @maximthomas in #1179
• [#1180] Document debug log rotation requirements by @vharseko in #1181
• [#1174] WindowsDesktopSSO: fail instead of ignore when the token check rejects the token by @maximthomas in #1183
• [#1182] Harden debug configuration parsing by @vharseko in #1184
• [#1175] Restart CTS persistent search after connection loss by @vharseko in #1176
• Make openam-core-rest tests independent of class order for InjectorHolder by @maximthomas in #1186
• CVE-2026-111755 CVE-2026-111756 follow-redirects: Credential headers forwarded on cross-origin redirects (1.16.0 -> 1.16.1) by @dependabot[bot] in #1189
• [#1187] Install the Guice module loader before the suite in openam-scripting and openam-audit-context tests by @maximthomas in #1188
• CVE-2026-112942 CVE-2026-112943 CVE-2026-112944 CVE-2026-112945 CVE-2026-112946 vite: Dev-server command injection via bundled launch-editor and server.fs bypass (8.0.16 -> 8.3.5) by @dependabot[bot] in #1190
• CVE-2026-111758 CVE-2026-111766 markdown-it: Quadratic-time DoS in multi-line reference definitions and inline HTML (14.3.2 -> 14.3.3) by @dependabot[bot] in #1191
• Update org.openidentityplatform.opendj to 5.2.0 by @vharseko in #1102

New Contributors

• @nicholascowan made their first contribution in #1161

Full Changelog: 16.1.3...16.1.4

Backers

Thank you to all our backers! Become a backer 🙏

Sponsors

Support this project by becoming a sponsor. Your logo will show up here with a link to your website. Become a sponsor ❤️