CVE-2026-62379
Received Received - Intake

OpenAM Pre-Authentication Java Deserialization Vulnerability

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, the pre-authentication /authservice PLL endpoint accepts a CustomCallback XML element whose className value selects an arbitrary Java class for AuthXMLUtils to load and instantiate without verifying that it implements DSAMECallbackInterface. Default configurations expose the endpoint without authentication, allowing attacker-controlled class initialization and unsafe deserialization of a serialized Subject value to execute code in the server process. Enabling sunRemoteAuthSecurityEnabled does not prevent the vulnerable parsing and instantiation because its check occurs later. This issue is fixed in version 16.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-62379
EUVD
EUVD-2026-78354

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
forgerock openam 16.1.2
openidentityplatform openam to 16.1.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-470 The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a critical unauthenticated remote code execution (RCE) vulnerability in OpenAM versions up to 16.1.1. It exists in the /authservice (PLL) endpoint which accepts XML input specifying an arbitrary Java class. The server loads and instantiates this class without proper validation, allowing attackers to execute arbitrary code on the server. The flaw involves unsafe reflection and improper control of code generation.

Detection Guidance

Check if OpenAM versions up to 16.1.1 are running by inspecting server logs or running commands like 'curl -s http://<target>/openam/version' or 'java -jar /path/to/openam.war --version'. Monitor network traffic for POST requests to /authservice with XML payloads containing <CustomCallback> elements.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on the server with full system compromise. Since it is unauthenticated and affects default configurations, attackers can gain complete control over the OpenAM server without any prior access or credentials. This could lead to data breaches, system takeover, or further network infiltration.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized code execution leading to potential data breaches. GDPR requires protection against unauthorized access to personal data, while HIPAA mandates safeguards for protected health information. A successful exploit would result in unauthorized access, compromising compliance.

Mitigation Strategies

Upgrade OpenAM to version 16.1.2 or later immediately. If upgrading is not possible, restrict access to the /authservice endpoint via firewall rules or network perimeter controls. Block XML requests containing <CustomCallback> elements with className attributes at the network level.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62379. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart