Most recent entries from all

EUVD-2026-368480

fkie_cve-2026-47424

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, GroovySandboxValueFilter permits an authenticated server-side script author to escape the scripting sandbox despite the default class allow and deny lists. A user such as a sub-realm RealmAdmin who can create or edit a script in an executed context can invoke operating-system commands as the OpenAM application server account, crossing the realm-scoped administration boundary and compromising the JVM and every realm it serves. This issue is fixed in version 16.1.1.

GHSA-69j4-qvqr-hpw3 — OpenAM Authenticated RCE via Groovy Sandbox Escape

Affected: Maven: org.openidentityplatform.openam:openam-scripting

## Summary

**Description**

A Protection Mechanism Failure (CWE-693) in OpenAM's server-side scripting sandbox allows an authenticated script author execute operating-system commands from the OpenAM JVM with the default class allow and deny lists. This impacts OpenAM Community Edition through version 16.0.6. This issue was patched in version 16.1.1.

## Impact An authenticated user (for example, a realm admin) who can create or edit server-side scripts for an executed context can run OS commands as the OpenAM application server admin. For a sub-realm `RealmAdmin`, this crosses the documented boundary from realm-scoped administration to JVM/host execution, effectively compromising the whole OpenAM process and every realm it serves. The sandbox is the only code-level defense between a realm script author and arbitrary JVM/OS execution.

## Patch This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.

UBUNTU-CVE-2026-47424

Affected: Ubuntu:16.04:LTS: openam