Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
☕
☕ Maven
Not in CISA KEV
CRITICAL severity

CVE-2026-62379 — openam-core

CRITICALFix: OpenIdentityPlatform/OpenAM@edcf968

CVE-2026-62379 is a critical-severity (CVSS 9.8) Code Injection vulnerability in org.openidentityplatform.openam:openam-core. A fix is available for org.openidentityplatform.openam:openam-core — see the affected versions and patch details below.

OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

Also known asGHSA-wg5r-wc3x-39vc
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Oct 22, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
  • A successful exploit gives an attacker total control of the affected component, not partial access.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-62379.

EPSS Exploitation Probability

via FIRST.org ↗
1.1%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs64th percentile — riskier than 64% of all scored CVEsHighest risk
0.57%0.90%1.23%1.57%1.1%1.1%Oct 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

CVE-2026-62379 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 394,803 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

1 pkg affected
☕org.openidentityplatform.openam:openam-core

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Summary

A pre-authentication remote code execution vulnerability affects OpenAM. The remote authentication endpoint (/authservice, PLL) accepts an XML element that names an arbitrary Java class, which the server then loads and instantiates without validation. On a default configuration this is reachable without authentication and allows an attacker to run code on the server.

Impact

Unauthenticated remote code execution / full server compromise on any OpenAM instance with default settings.

Affected

All releases up to and including 16.1.1 (the defect predates the Open Identity Platform fork).

Remediation

Upgrade to 16.1.2. The fix resolves the class named in a <CustomCallback> element without running its static initialisers and rejects it unless it implements DSAMECallbackInterface, and it constrains deserialisation of the serialised Subject value to a class allowlist.

Interim mitigation

If you cannot upgrade immediately:

  • Restrict or block external network access to /authservice. This is the only reliable mitigation.
  • Optionally, block PLL requests carrying a <CustomCallback className="..."> element at the reverse proxy or WAF. That element is only produced for custom DSAMECallbackInterface callbacks, so most deployments never send it — confirm against your own traffic before enforcing.
  • Enabling sunRemoteAuthSecurityEnabled does not mitigate this issue. The remote-auth security token is checked in AuthXMLHandler.processAuthXMLRequest, which runs only after AuthXMLRequest.parseXML has already parsed the request and instantiated the class named in the <CustomCallback className="..."> element. Do not rely on it as a substitute for upgrading or for network restriction.

Credit

Vulnerability discovered by Zhixi "Jace" Sun of ASM/VI at TikTok. Correction of the interim mitigation guidance contributed by @BarakSrour.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenorg.openidentityplatform.openam:openam-coreall versions16.1.2org.openidentityplatform.openam:openam-core:16.1.2

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.openidentityplatform.openam:openam-core, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update org.openidentityplatform.openam:openam-core to 16.1.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-62379 is resolved across your whole dependency graph.

  3. Workarounds

    Stop passing untrusted input into the interpreter or shell: call the affected binary with an argument array rather than a composed command string, reject anything outside a strict allowlist of expected values, and run the component under an account that cannot reach beyond the work it legitimately does.

Frequently Asked Questions

## Summary A pre-authentication remote code execution vulnerability affects OpenAM. The remote authentication endpoint (`/authservice`, PLL) accepts an XML element that names an arbitrary Java class, which the server then loads and instantiates without validation. On a default configuration this is reachable **without authentication** and allows an attacker to run code on the server. ## Impact Unauthenticated remote code execution / full server compromise on any OpenAM instance with default settings. ## Affected All releases up to and including 16.1.1 (the defect predates the Open Identity P
O3 Security · Impact-Aware SCA

Is CVE-2026-62379 in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2026-62379: openam-core RCE — Fixed in 16.1.2