CVE-2026-105115

HighCVSS 8.6/10Last modified Oct 6, 2026

Description

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/* with an unverified session identifier and a chosen class name, crashing the server, probing the classpath, or potentially reaching code execution via gadget chains.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Oct 3, 2026
Last modified: Oct 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1051166.1OpenAM before 16.1.3 contains a latent cross-site scripting defect that places the SAML message, relay state and target URL unencoded into t CVE-2026-1051176.1OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control notification email w CVE-2026-1051184.7OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverif CVE-2026-1051196.8OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose response_type is exactly code, so cod CVE-2026-105127.5The X25519 x86_64 assembly implementation fails to clear the most significant bit during the final modular reduction, so the computed result CVE-2026-1051204.9OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administ CVE-2026-1051214.9OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their CVE-2026-1051225.4OpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able to register or modify OAuth 2.0 clients CVE-2026-1051238.8W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary CVE-2026-1051246.1W (vincent-peugnet/wcms) through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject CVE-2026-1051253.7LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating CVE-2026-1051267.2LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate to Supe