Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-62379: OpenAM: Unauthenticated Remote Code Execution via Class.forName
GHSA-wg5r-wc3x-39vc
CVE-2026-62379
Summary
A security flaw in OpenAM allows an attacker to run code on the server without logging in. This affects all OpenAM versions up to 16.1.1. To fix this, update to version 16.1.2. If an update is not possible, consider restricting access to the affected endpoint or requiring authentication to prevent unauthorized access.
What to do
- Update org.openidentityplatform.openam:openam-core to version 16.1.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | – | org.openidentityplatform.openam:openam-core |
<= 16.1.1 Fix: upgrade to 16.1.2
|
Original title
OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback
Original description
## Summary
A pre-authentication remote code execution vulnerability affects OpenAM. The
remote authentication endpoint (`/authservice`, PLL) accepts an XML element
that names an arbitrary Java class, which the server then loads and
instantiates without validation. On a default configuration this is reachable
**without authentication** and allows an attacker to run code on the server.
## Impact
Unauthenticated remote code execution / full server compromise on any OpenAM
instance with default settings.
## Affected
All releases up to and including 16.1.1 (the defect predates the Open Identity
Platform fork).
## Remediation
Upgrade to `16.1.2`.
## Interim mitigation
- Require the remote-auth security token by enabling
`sunRemoteAuthSecurityEnabled` (rejects unauthenticated `/authservice` calls).
- Restrict or block external network access to `/authservice` until patched.
## Credit
Vulnerability discovered by Zhixi "Jace" Sun of ASM/VI at TikTok.
A pre-authentication remote code execution vulnerability affects OpenAM. The
remote authentication endpoint (`/authservice`, PLL) accepts an XML element
that names an arbitrary Java class, which the server then loads and
instantiates without validation. On a default configuration this is reachable
**without authentication** and allows an attacker to run code on the server.
## Impact
Unauthenticated remote code execution / full server compromise on any OpenAM
instance with default settings.
## Affected
All releases up to and including 16.1.1 (the defect predates the Open Identity
Platform fork).
## Remediation
Upgrade to `16.1.2`.
## Interim mitigation
- Require the remote-auth security token by enabling
`sunRemoteAuthSecurityEnabled` (rejects unauthenticated `/authservice` calls).
- Restrict or block external network access to `/authservice` until patched.
## Credit
Vulnerability discovered by Zhixi "Jace" Sun of ASM/VI at TikTok.
ghsa CVSS3.1
9.8
Vulnerability type
CWE-94
Code Injection
CWE-470
Published: 24 Jul 2026 · Updated: 24 Jul 2026 · First seen: 24 Jul 2026