Alex-Sc

**Name of the Vulnerable Software and Affected Versions** OpenAM versions prior to 16.1.3 **Description** The legacy JAX-RPC SOAP interface contains an unauthenticated arbitrary class instantiation flaw. Remote attackers can send SOAP requests to the endpoint '/jaxrpc/*' using an unverified session identifier and a specific class name. This can lead to server crashes, classpath probing, or potential remote code execution through gadget chains, which are sequences of existing code fragments used to achieve an unintended goal. **Recommendations** Update to version 16.1.3 or later. Restrict access to the '/jaxrpc/*' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenAM versions prior to 16.1.3 **Description** A server-side request forgery (SSRF) issue exists where attackers with permissions to register or modify OAuth 2.0 clients can force the server to fetch internal resources. This occurs through the use of an unvalidated `jwks uri` variable. By leveraging client-authentication and ID-token validation, unauthenticated fetches can be triggered to probe internal hosts, metadata endpoints, or local files, or to cause a denial of service by exhausting request threads. **Recommendations** Update to version 16.1.3 or later.