CVE-2026-47424: OpenIdentityPlatform OpenAM RCE via Groovy sandbox escape

Executive brief

OpenAM is an open-source access management platform used to secure web applications and services. A security flaw in its scripting engine allows an authorized administrator to bypass security restrictions and execute commands directly on the underlying server. This could lead to a complete takeover of the server, potentially exposing sensitive user data and compromising all managed security realms.

Technical details

A Protection Mechanism Failure (CWE-693) exists in the OpenAM server-side scripting sandbox. The vulnerability stems from insufficient class allow and deny lists, which allow an authenticated user with script-authoring privileges (such as a Realm Admin) to escape the Groovy sandbox. By crafting a malicious script, an attacker can execute arbitrary operating system commands within the context of the OpenAM JVM. This bypasses the intended administrative boundaries between sub-realms and the host system. The issue is fixed in OpenAM Community Edition version 16.1.1.

Affected products

• OpenIdentityPlatform OpenAM Community Edition <= 16.0.6

Timeline

• 2026-06-27: disclosed
• 2026-06-29: advisory: GitHub Advisory published

References

• https://api.github.com/users/wodzen
• https://github.com/wodzen
• https://api.github.com/users/wodzen/gists%7B/gist_id%7D
• https://api.github.com/users/wodzen/repos
• https://avatars.githubusercontent.com/u/25558174?v=4
• https://api.github.com/users/wodzen/events%7B/privacy%7D