16.0.6

What's Changed

• CVE-2026-2391 qs's arrayLimit bypass in comma parsing allows denial of service by @dependabot[bot] in #960
• CVE-2026-32141 CVE-2026-33228 flatted vulnerable to unbounded recursion DoS in parse() + Prototype Pollution via parse() in NodeJS flatted by @dependabot[bot] in #966
• CVE-2026-33439 Pre-Authentication Remote Code Execution via jato.clientSession Deserialization in OpenAM by @maximthomas thanks @iamnoooob @hacktronai-research
• Can't set the SameSite cookie attribute in XUI by @maximthomas thanks @IvanAndrukh #965
• Update opendj.version to 5.0.4 by @vharseko in #964

Full Changelog: 16.0.5...16.0.6

16.0.5

What's Changed

• CVE-2025-67735 Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder by @dependabot[bot] in #949
• CVE-2025-15284 qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion by @dependabot[bot] in #950
• CVE-2025-13465 Lodash has Prototype Pollution Vulnerability in _.unset and _.omit functions by @dependabot[bot] in #953
• CVE-2025-13465 Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. by @maximthomas in #954
• [#951] Set explicit xmlsec dependency for openam-federation-library by @maximthomas in #952 thanks @igieon
• [#955] Update JSTL to Jakarta 2.0.0 version by @maximthomas in #957 thanks @FireBurn
• [#956] Add OpenAM secondary instances to the Docker test in build.yml by @maximthomas in #959 thanks @FireBurn
• Update org.openidentityplatform.opendj to 5.0.3 by @vharseko in #947
• fix javadoc build by @maximthomas in #948

Full Changelog: 16.0.4...16.0.5

16.0.4

What's Changed

• CVE-2025-66453 Rhino has high CPU usage and potential DoS by @dependabot[bot] in #943
• CVE-2025-12183 CVE-2025-66566 LZ4 vulnerabilities by @maximthomas in #946
• Update ESAPI to 2.7.0.0 and switch to the jakarta classifier by @maximthomas in #938
• Update org.openidentityplatform.opendj to 5.0.2 by @vharseko in #940
• Fix Fedlet blank index page by @maximthomas in #939
• Docs: set supported Java and Tomcat versions by @maximthomas in #944

Full Changelog: 16.0.3...16.0.4

16.0.3

What's Changed

• Update target JDK to 11 and move to JakartaEE 9 by @maximthomas in #889
• Add support LTS JDK 25 by @vharseko in #924
• Update base docker image Java version to 25 LTS by @maximthomas in #927
• CVE-2023-45133: Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code by @maximthomas in #922
• CVE-2024-53382 PrismJS DOM Clobbering vulnerability (update swagger-ui) by @maximthomas in #923
• CVE-2025-64099 Using arbitrary OIDC requested claims values in id_token and user_info is allowed
• Fix OAuth2 issues: Restore 'none' token endpoint auth method. Do not add default openid scope if non-empty. by @maximthomas in #926
• Shade BC libs to avoid conflict with BC FIPS by @maximthomas in #930
• [#931] Update OpenDMK external library to fix SNMP monitoring by @maximthomas in #932
• Update org.openidentityplatform.opendj to 5.0.1 by @vharseko in #933
• Fix documentation auth modules duplicate attributes by @maximthomas in #921
• Build & deploy: add branch sustaining/15.2.x by @vharseko in #925
• Set the project version for transformed artifacts. by @maximthomas in #934

Full Changelog: 15.2.2...16.0.3

15.2.2

What's Changed

• CVE-2025-8916 Allocation of Resources Without Limits or Throttling vulnerability by @maximthomas in #909
• CVE-2025-9288 ha.js is missing type checks leading to hash rewind and passing on crafted data by @dependabot[bot] in #908
• CVE-2025-26467 Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions by @dependabot[bot] in #911
• CVE-2025-5889 brace-expansion Regular Expression Denial of Service vulnerability by @dependabot[bot] in #914
• [#913] CVE-2024-38999 requirejs v2.3.6 was discovered to contain a prototype pollution by @maximthomas in #915
• CVE-2025-58056 Netty vulnerable to request smuggling due to incorrect parsing of chunk extensions by @dependabot[bot] in #919
• CVE-2025-8662 Tampering with request parameters may modify OpenAM’s internal cache, causing the SAML IdP to not function properly by @tsujiguchitky in #920
• Fix JavaDoc build error in GitHub actions by @maximthomas in #906
• Update README.md: add backers and sponsor by @vharseko in #907
• ISSUE_TEMPLATE: add "Vote to raise the priority" by @vharseko in #910
• Bump org.openidentityplatform.opendj 4.10.2 by @vharseko in #918
• Generate authentication modules reference in AsciiDoc format by @maximthomas in #916

Full Changelog: 15.2.1...15.2.2

15.2.1

What's Changed

• CVE-2025-7783 form-data uses unsafe random function in form-data for choosing boundary by @dependabot[bot] in #890
• CVE-2025-7783: Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution by @maximthomas in #894
• Bump org.openidentityplatform.opendj 4.10.1 by @vharseko in #895
• [#896] CVE-2022-34169 Apache Xalan Java XSLT library integer truncation issue when processing malicious XSLT stylesheets by @vharseko in #897
• CVE-2025-54798 tmp allows arbitrary temporary file / directory write via symbolic link dir parameter by @dependabot[bot] in #898
• Remove import javax.xml.rpc StringHolder (make inner) by @vharseko in #901
• Run frontend Karma tests during the Maven test phase by @maximthomas in #902
• [#903] Fix ambiguous class loading from the Jato library by @maximthomas in #904

Full Changelog: 15.2.0...15.2.1

15.2.0

What's Changed

• CVE-2019-11358 CVE-2020-11023 Update jQuery to 3.7.1 by @maximthomas in #878
• CVE-2025-48976 Apache Commons FileUpload: FileUpload DoS via part headers by @dependabot[bot] in #883
• CVE-2025-48924 Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs by @vharseko in #887
• CVE-2025-48734 Apache Commons Improper Access Control vulnerability by @dependabot[bot] in #870
• CVE-2018-8039 Apache CXF TLS hostname verification does not work correctly with com.sun.net.ssl.* by @dependabot[bot] in #871
• [#877] Return Bad Request error if CORS failed by @maximthomas in #882
• [#872] Add root group permission to the Docker $CATALINA_HOME directory by @maximthomas in #879
• FIX: Failed to execute goal org.apache.maven.plugins:maven-shade-plugin:3.2.1:shade Unsupported class file major version 61 by @vharseko in #885
• Bump org.openidentityplatform.opendj 4.10.0 by @vharseko in #888
• Docker integration test with OpenDJ separate instance by @maximthomas in #866
• Increase timeout for Chrome startup to 60s by @FireBurn in #869
• Deploy: migrating from Legacy OSSRH to Central Portal by @vharseko in #875
• Migrate tests from using fest-assert to AssertJ by @aldaris in #876

Full Changelog: 15.1.6...15.2.0

15.1.6

What's Changed

• [#859] Drop Oracle Directory Server Enterprise Edition support as configuration datastore by @maximthomas in #861
• [#859] Warn and continue loading LDIF schemas on install by @maximthomas in #860
• Add support Java SE 24 by @vharseko in #857
• Bump org.openidentityplatform.opendj to 4.9.4 by @vharseko in #854
• Add integration test with OpenDJ Docker container by @maximthomas in #863
• Update documentation formatting by @maximthomas in #867

Full Changelog: 15.1.5...15.1.6

15.1.5

What's Changed

• CVE-2025-27497 Fix Denial of Service (Dos) using alias loop by @vharseko in #843
• CVE-2025-26791 Bump dompurify and swagger-ui in /openam-ui/openam-ui-api by @dependabot in #856
• Fail fast when updating OpenDJ schema on OpenAM setup by @maximthomas in #849
• Add RemoteIpValve to the server.xml in Docker image by @maximthomas in #850 thanks @AndressRod
• [#845] Setup with embedded DJ may crash by @vharseko in #853 thanks @YinHangCode
• [#848] Fix OAuth2 error when use Connection: close header by @maximthomas in #855 thanks @AndressRod
• Docs: disable timestamp in javadoc by @maximthomas in #842
• Change github action distribution temurin->zulu by @vharseko in #841
• Bump @babel/runtime from 7.24.5 to 7.26.10 in /openam-ui/openam-ui-api by @dependabot in #847
• Bump axios from 1.7.7 to 1.8.3 in /openam-ui/openam-ui-api by @dependabot in #851
• Bump @babel/runtime-corejs3 from 7.25.6 to 7.26.10 in /openam-ui/openam-ui-api by @dependabot in #852

Full Changelog: 15.1.4...15.1.5

15.1.4

What's Changed

• Migrate form PhantomJS to Chrome to fix UI test crash in Ubuntu by @maximthomas in #829
• Use generic authenticator app for push by @maximthomas in #830
• Update documentation & fix issues by @maximthomas in #831
• Bump org.apache.cassandra:cassandra-all from 4.0.11 to 4.0.16 in /openam-cassandra by @dependabot in #833
• Bump opendj.version 4.9.2 by @vharseko in #832
• Documentation update by @maximthomas in #834
• [#836] Docs: add access to the encapsulated java classes for Java 11 and above by @maximthomas in #837
• Docs: Drop JDK 7 support and remove MetaspaceSize options by @maximthomas in #838
• Bump netty to 4.1.118.Final by @maximthomas in #839

Full Changelog: 15.1.3...15.1.4