Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-62379: OpenAM allows unauthenticated code execution via custom XML
CVE-2026-62379 · published 17 days ago
Summary
OpenAM versions before 16.1.2 expose a pre‑authentication endpoint that accepts a specially crafted XML request. An attacker can supply a class name that the server loads and runs, letting them execute code on the server without any login. Update OpenAM to version 16.1.2 or later, or block the vulnerable endpoint until the upgrade can be applied.
What to do
- Update openidentityplatform org.openidentityplatform.openam:openam-core to version 16.1.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | openidentityplatform | openam | < 16.1.2 |
| maven | openidentityplatform | org.openidentityplatform.openam:openam-core |
<= 16.1.1 Fix: upgrade to 16.1.2
|
| Ubuntu:16.04:LTS | canonical | openam | All versions |
Original advisory text
OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, the pre-authentication /authservice PLL endpoint accepts a CustomCallback XML element whose className value selects an arbitrary Java class for AuthXMLUtils to load and instantiate without verifying that it implements DSAMECallbackInterface. Default configurations expose the endpoint without authentication, allowing attacker-controlled class initialization and unsafe deserialization of a serialized Subject value to execute code in the server process. Enabling sunRemoteAuthSecurityEnabled does not prevent the vulnerable parsing and instantiation because its check occurs later. This issue is fixed in version 16.1.2.
References
- https://github.com/advisories/GHSA-wg5r-wc3x-39vc
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62379... Vendor Advisory
- https://github.com/OpenIdentityPlatform/OpenAM/commit/edcf968cad91a78b932dba4ad5... Patch
- https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-wg5r-wc3... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-62379 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-62379 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-62379 Third Party Advisory
- https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.2 URL
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-94Code Injection
CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Timeline
Published15 Sep 2026
Updated2 Oct 2026
First seen24 Jul 2026
Sources
GHSA-wg5r-wc3x-39vc · GHSA
CVE-2026-62379 · NVD
CVE-2026-62379 · MITRE
CVE-2026-62379 · OSV
UBUNTU-CVE-2026-62379 · OSV
Track software like this
Free during beta