OpenAM 16.1.4
OpenAM 16.1.4 was published on 22 October 2026. These notes describe that released version. Documentation built from a development branch can also describe changes intended for a later release; a SNAPSHOT build is not a published release.
The 16.1.4 release record lists the assets and changes. The comparison with 16.1.3 provides the corresponding source history. For newer releases, consult the release list.
Selected Changes
The release includes the following changes, among others:
-
Security fixes for built-in accounts with shipped credentials, notification WebSocket session disclosure, self-registration attribute validation, and SAML assertion verification.
-
Redirect validation for login, SAML, and WS-Federation, plus restrictions on server-side fetching of CRLs, federation metadata, and UMA scope descriptions.
-
OAuth 2.0 device flow fixes for CSRF protection, PKCE, expired device codes, session propagation, and OIDC claims.
-
WindowsDesktopSSO improvements for completing authentication from a Negotiate header, retrying expired service credentials, and rejecting invalid tokens.
-
CTS persistent-search recovery after connection loss, LDAP DN rule parsing fixes, and an update to OpenDJ 5.2.0.
-
Dependency and Docker image security updates, and corrections to the guides and debug logging configuration.
This is a summary. Use the release record to identify individual fixes and their pull requests.
Fixed Security Advisories
The following published advisories identify 16.1.4 as a patched version:
-
Accounts and sessions: GHSA-hvfc-4v4r-8p9w (shipped credentials), GHSA-5c3q-hp86-xjr8 (WebSocket session disclosure), and GHSA-jv8f-m88g-h6mm (self-registration).
-
Federation message verification and encoding: GHSA-3j2f-qhrc-rjfj (SAML v2.0 assertions), GHSA-j56q-q3r3-hg7f (SAML 1.x signer binding), and GHSA-pw99-8h4m-p3gm (SAML 1.x form encoding).
-
Redirects: GHSA-2gwf-vxp5-f9v2 (goto/gotoOnFail open redirect and cross-site scripting), GHSA-fhqm-62hv-4phw (SAML v2.0 RelayState without a URL list), GHSA-mgwg-24cx-c8w3 (unchecked WS-Federation and SAML v2.0 redirects), and GHSA-rw43-r238-4c7j (SAML 1.x trusted-partner matching).
-
Server-side requests: GHSA-g5vw-v384-gw9v (CRLs), GHSA-rmw3-j353-w9f7 (federation metadata), and GHSA-7q42-6xr7-9rmw (UMA scope descriptions).
-
OAuth 2.0 device authorization and consent: GHSA-545c-rm35-2jj2 (CSRF), GHSA-h93p-35jm-rj83 (PKCE), and GHSA-v6hq-3cfh-5gr6 (consent page encoding).
-
Internal protocols and deserialization: GHSA-6gg2-2v5m-454x (SOAP response validation) and GHSA-x7wr-5gxg-v833 (unbounded deserialization).
Review the published security advisories for affected versions, impact, remediation, and subsequent disclosures. Dependency fixes are also listed in the release record. An older release’s fix can be incomplete; check follow-up advisories when selecting an upgrade target.
Distributions
The release provides the following assets:
| Asset | Purpose |
|---|---|
|
Server web application for deployment in a compatible servlet container. |
|
Distribution archive containing OpenAM components and tools. |
|
Server-only web application. |
|
Separate console web application. |
|
Administration command-line tools, including |
|
Command-line configuration and upgrade tools. |
|
Fedlet distribution for SAML service provider integration. |
|
Docker image build instructions. |
The project also publishes the OpenAM Docker image. See the Getting Started Guide for an evaluation and the Installation Guide for deployment procedures.
Before installation or upgrade, read Requirements and Upgrade Considerations.