Vulnerability · Published Oct 3, 2026 · Assigned by VulnCheck

CVE-2026-105115OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface

High 8.6

In plain English

A high-severity missing authentication in OpenAM from OpenIdentityPlatform. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.5%top 59.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/* with an unverified session identifier and a chosen class name, crashing the server, probing the classpath, or potentially reaching code execution via gadget chains.

Affected products (as reported)

Vendor	Product	Versions
OpenIdentityPlatform	OpenAM	0 – before 16.1.3

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

References

GitHub Security Advisory (GHSA-wxmx-q96f-w4gw) vendor-advisory
VulnCheck Advisory: OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface third-party-advisory