AIKIDO-2026-882208

openam-entitlements is vulnerable to Remote Code Execution

Remote Code ExecutionCVE-2026-63468 Published Aug 11, 2026

Critical Risk

This Affects:

openam-entitlements

0.0.1 - 16.1.1

Fixed in 16.1.2

Are you affected? Scan for Free

TL;DR

The XACML policy import endpoint instantiates arbitrary Java classes named in untrusted XACML XML. XACMLPrivilegeUtils.createDefaultObject calls Class.forName(name).newInstance() with no allowlist, and the type check runs only after instantiation. The target class static initializer and constructor execute during import, so any class on the classpath with a no-argument constructor can run code. The fix loads classes without initialization and rejects any that do not implement the expected entitlement type before instantiation.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and XACML policy import accepts policy content that can be influenced by an untrusted party.