CVE History & Patch Matrix
| CVE | Year | CVSS | Component | Description | ForgeRock CE 11.0.3 | OIP OpenAM | Wren:AM |
|---|---|---|---|---|---|---|---|
| CVE-2021-35464 | 2021 | 9.8 Critical | OpenAM core (Jato) | Pre-auth RCE via Java deserialization — actively exploited in the wild. Metasploit module available. CISA advisory issued. ⚠ Most dangerous: unauthenticated RCE with public exploit tooling | Unpatched | Patched | Patched |
| CVE-2021-29156 | 2021 | 7.5 High | OpenAM core (Webfinger) | LDAP injection via Webfinger endpoint — character-by-character retrieval of password hashes and session tokens. | Unpatched | Patched | Patched |
| CVE-2024-38999 | 2024 | 9.8 Critical | RequireJS (OpenAM, OpenIDM, OpenIG) | Prototype pollution via RequireJS — affects 3 OIP components simultaneously. | Unpatched | Patched | N/A |
| CVE-2022-1471 | 2022 | 9.8 Critical | SnakeYaml (OpenAM) | Constructor deserialization RCE — arbitrary code execution via YAML parsing. | Unpatched | Patched | Patched |
| CVE-2022-42889 | 2022 | 9.8 Critical | Apache Commons Text | Arbitrary code execution via string interpolation ("Text4Shell"). | Unpatched | Patched | Unknown |
| CVE-2021-35043 | 2021 | 6.1 Medium | OWASP AntiSamy (OpenAM) | XSS via crafted HTML attributes bypassing AntiSamy sanitizer. | Unpatched | Patched | Patched |
| CVE-2022-24670 | 2022 | — | OpenAM core | OpenAM-specific vulnerability (ForgeRock internal advisory). | Unpatched | Unknown | Patched |
| CVE-2025-27497 | 2025 | Medium | All OIP components | DoS via alias loop — affects OpenAM, OpenDJ, OpenIDM, OpenIG, OpenICF simultaneously. | Unpatched | Patched | N/A |
| CVE-2025-8662 | 2025 | Medium | OpenAM core (SAML IdP) | Request parameter tampering modifies internal cache — SAML IdP dysfunction. | Unpatched | Patched | N/A |
| CVE-2019-10172 | 2019 | 7.5 High | Jackson-mapper-asl (OpenAM) | XXE injection via XML parsing in legacy Jackson library. | Unpatched | Patched | Partial |
| CVE-2018-8039 | 2018 | 8.1 High | Apache CXF (OpenAM) | TLS hostname verification bypass — enables man-in-the-middle attacks. | Unpatched | Patched | Patched |
Security & CVE History
Executive Summary
The ForgeRock/OpenAM ecosystem has accumulated a significant vulnerability history across its forks. The most critical vulnerability is CVE-2021-35464 (CVSS 9.8), a pre-auth RCE via Java deserialization in the Jato framework, which was actively exploited in the wild and prompted a CISA advisory. CVE-2021-29156 (CVSS 7.5) demonstrated LDAP injection via the Webfinger protocol. The OIP fork (OpenAM) is the most active in patching dependencies, with 50+ CVE-related commits across repos. The frozen ForgeRock CE 11.0.3 (last updated Nov 2017) is permanently unpatched against all post-2017 vulnerabilities. Wren:AM has patched the critical OpenAM-specific CVEs (CVE-2021-35464, CVE-2021-29156, CVE-2022-24670, etc.) but has fewer total dependency-fix commits than OIP. Across all repos, the most common vulnerability categories are: dependency vulnerabilities (prototype pollution, deserialization), DoS via resource exhaustion, and injection flaws (LDAP, XXE, XSS).
Detailed Findings
CVE Timeline
Major CVEs affecting ForgeRock/OpenAM products, chronologically:
| CVE ID | Year | CVSS | Component | Description | OWASP Category |
|---|---|---|---|---|---|
| CVE-2016-3092 | 2016 | 7.5 | Commons FileUpload (OpenAM, OpenDJ, OpenIG) | DoS via long boundary string | A06:2021 Vulnerable Components |
| CVE-2016-1000031 | 2016 | 9.8 | Commons FileUpload | DiskFileItem RCE | A06:2021 Vulnerable Components |
| CVE-2017-14394 | 2017 | — | OpenAM | OpenAM vulnerability (patched by Wren:AM) | — |
| CVE-2018-0696 | 2018 | — | OpenAM | OpenAM vulnerability (patched by Wren:AM) | — |
| CVE-2018-8039 | 2018 | 8.1 | Apache CXF (OpenAM) | TLS hostname verification bypass — MITM | A07:2021 Identification Failures |
| CVE-2018-11775 | 2018 | 7.4 | ActiveMQ (OpenAM) | TLS hostname verification missing | A07:2021 Identification Failures |
| CVE-2018-16487 | 2018 | 5.6 | Lodash (OpenAM, OpenIG) | Prototype pollution in merge/mergeWith | A06:2021 Vulnerable Components |
| CVE-2019-10172 | 2019 | 7.5 | Jackson-mapper-asl (OpenAM) | XXE injection | A03:2021 Injection |
| CVE-2019-10744 | 2019 | 9.1 | Lodash (OpenAM, OpenIG) | Prototype pollution | A06:2021 Vulnerable Components |
| CVE-2019-12400 | 2019 | 5.5 | Apache Santuario (OpenAM) | Malicious DocumentBuilder caching | A08:2021 Software Integrity |
| CVE-2019-17495 | 2019 | 6.1 | Swagger UI (OpenAM, OpenIDM) | XSS in API documentation | A03:2021 Injection |
| CVE-2019-9658 | 2019 | 5.3 | Checkstyle (OpenDJ, OpenIG) | External DTD loading — info leak/DoS | A05:2021 Security Misconfiguration |
| CVE-2020-36604 | 2020 | 8.1 | Hoek (OpenAM) | Prototype pollution | A06:2021 Vulnerable Components |
| CVE-2021-29156 | 2021 | 7.5 | OpenAM core | LDAP injection via Webfinger — password hash / session token retrieval | A03:2021 Injection |
| CVE-2021-35464 | 2021 | 9.8 | OpenAM core (Jato) | Pre-auth RCE via Java deserialization — actively exploited | A08:2021 Software Integrity |
| CVE-2021-35043 | 2021 | 6.1 | OWASP AntiSamy (OpenAM) | XSS via HTML attributes | A03:2021 Injection |
| CVE-2021-4201 | 2021 | — | OpenAM | OpenAM vulnerability (patched by Wren:AM) | — |
| CVE-2022-24670 | 2022 | — | OpenAM | OpenAM vulnerability (patched by Wren:AM) | — |
| CVE-2022-1471 | 2022 | 9.8 | SnakeYaml (OpenAM) | Constructor deserialization RCE | A08:2021 Software Integrity |
| CVE-2022-42889 | 2022 | 9.8 | Apache Commons Text (OpenAM) | Arbitrary code execution via interpolation | A03:2021 Injection |
| CVE-2022-34169 | 2022 | 7.5 | Apache Xalan (OpenAM) | XSLT integer truncation | A06:2021 Vulnerable Components |
| CVE-2023-34462 | 2023 | 6.5 | Netty (OpenAM) | SniHandler 16MB allocation DoS | A06:2021 Vulnerable Components |
| CVE-2023-4586 | 2023 | 6.5 | Netty (OpenAM) | Host name validation bypass | A07:2021 Identification Failures |
| CVE-2023-22102 | 2023 | 8.3 | MySQL Connector (OpenIDM, OpenICF) | Connector compromise | A06:2021 Vulnerable Components |
| CVE-2024-47535 | 2024 | 5.5 | Netty (OpenAM) | DoS on Windows | A06:2021 Vulnerable Components |
| CVE-2024-47554 | 2024 | — | Commons IO (OpenAM, OpenICF) | DoS via XmlStreamReader | A06:2021 Vulnerable Components |
| CVE-2024-38999 | 2024 | 9.8 | RequireJS (OpenAM, OpenIDM, OpenIG) | Prototype pollution | A06:2021 Vulnerable Components |
| CVE-2025-8662 | 2025 | — | OpenAM core | Request parameter tampering modifies internal cache — SAML IdP dysfunction | A04:2021 Insecure Design |
| CVE-2025-27497 | 2025 | — | OpenAM, OpenDJ, OpenIDM, OpenIG, OpenICF | DoS via alias loop — affects ALL OIP components | A06:2021 Vulnerable Components |
| CVE-2026-1225 | 2026 | — | Logback (OpenDJ) | Arbitrary class instantiation | A06:2021 Vulnerable Components |
Patch Matrix
| CVE ID | Severity | ForgeRock CE 11.0.3 | OIP OpenAM | Wren:AM | Notes |
|---|---|---|---|---|---|
| CVE-2021-35464 | Critical (9.8) | UNPATCHED | Patched (workaround #372) | Patched (PR #123) | CISA advisory; actively exploited |
| CVE-2021-29156 | High (7.5) | UNPATCHED | Patched (commit f1fba81) | Patched (PR #130) | LDAP injection via Webfinger |
| CVE-2022-1471 | Critical (9.8) | UNPATCHED | Patched (#588) | Patched (dep cleanup #159) | SnakeYaml deserialization RCE |
| CVE-2022-42889 | Critical (9.8) | UNPATCHED | Patched (commit e298fa5) | Unknown | Commons Text RCE |
| CVE-2022-24670 | Medium | UNPATCHED | Unknown | Patched (PR #128) | OpenAM-specific |
| CVE-2017-14394 | Medium | UNPATCHED | Unknown | Patched (PR #126) | OpenAM-specific |
| CVE-2018-0696 | Medium | UNPATCHED | Unknown | Patched (PR #125) | OpenAM-specific |
| CVE-2021-4201 | Medium | UNPATCHED | Unknown | Patched (PR #124) | OpenAM-specific |
| CVE-2025-27497 | Medium | UNPATCHED | Patched (all repos) | N/A | Alias loop DoS — cross-component |
| CVE-2025-8662 | Medium | UNPATCHED | Patched (#920) | N/A | SAML IdP cache tampering |
| CVE-2024-38999 | Critical (9.8) | UNPATCHED | Patched (3 repos) | N/A | RequireJS prototype pollution |
Notable Vulnerabilities — Detailed Analysis
CVE-2021-35464: Pre-Authentication Remote Code Execution (CVSS 9.8)
Impact: Complete system compromise without authentication. An attacker can execute arbitrary code by sending a single crafted HTTP request to the /ccversion/* endpoint. The vulnerability exploits unsafe Java deserialization in the Jato framework used internally by OpenAM.
Affected versions: ForgeRock AM < 7.0 on Java 8. All OIP OpenAM versions (up to at least 14.x) were affected when running on Java 8.
Discovery: Reported by Michael Stepankin (PortSwigger). Publicly disclosed June 29, 2021.
Active exploitation: CISA issued alert AA21-193A on July 12, 2021. The Australian Cyber Security Centre (ACSC) issued Advisory 2021-004 confirming active exploitation. A Metasploit module exists (exploit/multi/http/cve_2021_35464_forgerock_openam).
Patch status:
- ForgeRock AM 7.0+: Not affected (removed
/ccversionendpoint and Jato entirely) - OIP OpenAM: Workaround applied in PR #372 (commit a267913)
- Wren:AM: Patched in PR #123
- ForgeRock CE 11.0.3: Permanently unpatched
Mitigation for unpatched systems: Run on Java 9+ (deserialization gadget chain does not work), or block /ccversion/* at the reverse proxy.
Sources:
- https://portswigger.net/research/pre-auth-rce-in-forgerock-openam-cve-2021-35464
- https://www.rapid7.com/blog/post/2021/06/30/forgerock-openam-pre-auth-remote-code-execution-vulnerability-what-you-need-to-know/
- https://www.cisa.gov/news-events/alerts/2021/07/12/critical-forgerock-access-management-vulnerability
CVE-2021-29156: LDAP Injection via Webfinger (CVSS 7.5)
Impact: Unauthenticated LDAP injection allowing character-by-character retrieval of password hashes, session tokens, or private keys from the LDAP directory backing OpenAM.
Affected versions: ForgeRock OpenAM before 13.5.1 (all versions using Webfinger endpoint).
Technical detail: The Webfinger protocol implementation did not sanitize user input before constructing LDAP queries, enabling blind LDAP injection attacks.
Sources:
- https://www.guidepointsecurity.com/blog/ldap-injection-in-forgerock-openam-exploiting-cve-2021-29156/
- https://nvd.nist.gov/vuln/detail/CVE-2021-29156
Git Security Commit Analysis
| Repo | CVE-related Commits | Security-keyword Commits | Total Security Activity |
|---|---|---|---|
| OpenAM | 53 | 34 | Highest — most dependency fixes |
| OpenDJ | 10 | 153 | High — many security-related code changes |
| OpenIDM | 17 | 77 | Moderate — dependency updates + code fixes |
| OpenIG | 20 | 3 | Moderate — mostly dependency CVE fixes |
| OpenICF | 9 | 1 | Low — fewer dependencies |
| openam-community-edition | 1 | 17 | Frozen — no CVE fixes since 2017 |
| wrenam | 8 | 18 | Moderate — focused on OpenAM-specific CVEs |
Risk Summary by Fork
ForgeRock Community Edition 11.0.3 (CRITICAL RISK)
- Last updated: November 2017
- Status: Frozen, no maintainer
- Unpatched critical CVEs: CVE-2021-35464 (RCE), CVE-2022-1471 (RCE), CVE-2022-42889 (RCE), CVE-2024-38999 (prototype pollution)
- Risk: Any internet-facing deployment is likely compromised or compromisable. Multiple pre-auth RCE exploits with public Metasploit modules.
- Recommendation: Immediate migration. Do not operate this version in any environment.
OIP OpenAM 16.0.5 (MODERATE RISK)
- Status: Actively maintained by Open Identity Platform community
- Patching cadence: Regular dependency updates; critical CVEs patched within weeks-months
- Strength: Broadest dependency coverage — patches across all 5 components
- Weakness: Small maintainer team; some CVE fixes lag months behind disclosure
- Recommendation: Viable for organizations willing to invest in monitoring and operational security. Pin to latest version, monitor GitHub advisories.
Wren:AM 16.0.0-M1 (MODERATE RISK)
- Status: Actively maintained by Wren Security (Orchitech Solutions)
- Patching cadence: Focused on OpenAM-specific vulnerabilities (CVE-2021-35464, CVE-2021-29156, CVE-2022-24670)
- Strength: Targeted patching of the most critical OpenAM-specific vulnerabilities
- Weakness: Fewer total dependency-fix commits than OIP; still in milestone (M1) status
- Recommendation: Viable alternative fork. Evaluate Wren Security’s roadmap and support model.
OWASP Category Breakdown
| OWASP Category | Count | Examples |
|---|---|---|
| A06:2021 Vulnerable and Outdated Components | 22 | Lodash prototype pollution, Netty DoS, Commons FileUpload, RequireJS |
| A03:2021 Injection | 6 | CVE-2021-29156 (LDAP), CVE-2019-10172 (XXE), CVE-2021-35043 (XSS), CVE-2022-42889 (expression injection) |
| A08:2021 Software and Data Integrity Failures | 4 | CVE-2021-35464 (deserialization RCE), CVE-2022-1471 (SnakeYaml), CVE-2019-12400 (DocumentBuilder cache) |
| A07:2021 Identification and Authentication Failures | 3 | CVE-2018-8039 (TLS bypass), CVE-2018-11775 (TLS bypass), CVE-2023-4586 (hostname validation) |
| A05:2021 Security Misconfiguration | 2 | CVE-2019-9658 (external DTD loading) |
| A04:2021 Insecure Design | 1 | CVE-2025-8662 (SAML IdP cache tampering) |
Key insight: The overwhelming majority (60%+) of CVEs are in third-party dependencies, not in OpenAM’s own code. This is characteristic of large Java applications with deep dependency trees. The most dangerous CVEs (CVE-2021-35464, CVE-2021-29156) are in OpenAM’s own code and are the most architecturally significant.
Known Gaps
- CVE-2017-14394, CVE-2018-0696, CVE-2021-4201, CVE-2022-24670: Referenced in Wren:AM git history but not found in NVD with detailed CVSS scores. These may be ForgeRock-internal advisory IDs later mapped to CVEs, or CVEs filed under different product names.
- ForgeRock’s archived security advisories (from before open-source closure) were not accessible during this research.
- CVSS scores marked ”—” could not be confirmed from NVD; these CVEs may be disputed, reserved, or filed under alternative identifiers.