CVE-2026-62379: OpenAM Remote Code Execution Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-wg5r-wc3x-39vc",
  "modified" : "2026-08-03T20:44:06Z",
  "published" : "2026-07-24T21:11:09Z",
  "aliases" : [ "CVE-2026-62379" ],
  "summary" : "OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback",
  "details" : "## Summary\nA pre-authentication remote code execution vulnerability affects OpenAM. The\nremote authentication endpoint (`/authservice`, PLL) accepts an XML element\nthat names an arbitrary Java class, which the server then loads and\ninstantiates without validation. On a default configuration this is reachable\n**without authentication** and allows an attacker to run code on the server.\n\n## Impact\nUnauthenticated remote code execution / full server compromise on any OpenAM\ninstance with default settings.\n\n## Affected\nAll releases up to and including 16.1.1 (the defect predates the Open Identity\nPlatform fork).\n\n## Remediation\nUpgrade to `16.1.2`. The fix resolves the class named in a `<CustomCallback>`\nelement without running its static initialisers and rejects it unless it\nimplements `DSAMECallbackInterface`, and it constrains deserialisation of the\nserialised `Subject` value to a class allowlist.\n\n## Interim mitigation\nIf you cannot upgrade immediately:\n\n- **Restrict or block external network access to `/authservice`.** This is the\n  only reliable mitigation.\n- Optionally, **block PLL requests carrying a `<CustomCallback className=\"...\">`\n  element** at the reverse proxy or WAF. That element is only produced for custom\n  `DSAMECallbackInterface` callbacks, so most deployments never send it — confirm\n  against your own traffic before enforcing.\n- **Enabling `sunRemoteAuthSecurityEnabled` does *not* mitigate this issue.** The\n  remote-auth security token is checked in `AuthXMLHandler.processAuthXMLRequest`,\n  which runs only after `AuthXMLRequest.parseXML` has already parsed the request\n  and instantiated the class named in the `<CustomCallback className=\"...\">`\n  element. Do not rely on it as a substitute for upgrading or for network\n  restriction.\n\n## Credit\nVulnerability discovered by Zhixi \"Jace\" Sun of ASM/VI at TikTok.\nCorrection of the interim mitigation guidance contributed by @BarakSrour.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.openidentityplatform.openam:openam-core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "16.1.2"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 16.1.1"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-wg5r-wc3x-39vc"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/OpenIdentityPlatform/OpenAM/commit/edcf968cad91a78b932dba4ad559ef94cbf35f5a"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/OpenIdentityPlatform/OpenAM"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.2"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-470", "CWE-94" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-24T21:11:09Z",
    "nvd_published_at" : null
  }
}