openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that permits any authenticated non‑guest user to run arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/*. Attackers bypass the class‑name denylist enforced by PluginAwareObjectInputStream by nesting a serialized payload inside a java.security.SignedObject. The inner stream is deserialized by a separate ObjectInputStream that does not apply the denylist, eventually reaching a JNDI sink and enabling code execution. This flaw is classified as CWE-184 and CWE-502.

Vulnerable installations are those built on the Apereo Foundation’s openEQUELLA platform with a version earlier than 2026.1.0. The flaw resides in the web component that processes HTTP invoker requests; any instance exposing the /invoker/* path is susceptible. No additional version constraints are documented, so all pre‑2026.1.0 builds should be considered at risk.

The severity is high, with a CVSS score of 8.7, but no EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, indicating no public evidence of exploitation yet. The risk is elevated for systems that expose the /invoker/ endpoint to authenticated users, as the attack requires valid credentials but can be triggered remotely through crafted HTTP requests. Organizations that cannot upgrade immediately should restrict endpoint access via firewall or VPN, limiting it to only those users who truly need it, while monitoring for suspicious activity.