{"id":"CVE-2026-62379","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-62379","summary":"OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback","details":"## Summary\nA pre-authentication remote code execution vulnerability affects OpenAM. The\nremote authentication endpoint (`/authservice`, PLL) accepts an XML element\nthat names an arbitrary Java class, which the server then loads and\ninstantiates without validation. On a default configuration this is reachable\n**without authentication** and allows an attacker to run code on the server.\n\n## Impact\nUnauthenticated remote code execution / full server compromise on any OpenAM\ninstance with default settings.\n\n## Affected\nAll releases up to and including 16.1.1 (the defect predates the Open Identity\nPlatform fork).\n\n## Remediation\nUpgrade to `16.1.2`. The fix resolves the class named in a `<CustomCallback>`\nelement without running its static initialisers and rejects it unless it\nimplements `DSAMECallbackInterface`, and it constrains deserialisation of the\nserialised `Subject` value to a class allowlist.\n\n## Interim mitigation\nIf you cannot upgrade immediately:\n\n- **Restrict or block external network access to `/authservice`.** This is the\n  only reliable mitigation.\n- Optionally, **block PLL requests carrying a `<CustomCallback className=\"...\">`\n  element** at the reverse proxy or WAF. That element is only produced for custom\n  `DSAMECallbackInterface` callbacks, so most deployments never send it — confirm\n  against your own traffic before enforcing.\n- **Enabling `sunRemoteAuthSecurityEnabled` does *not* mitigate this issue.** The\n  remote-auth security token is checked in `AuthXMLHandler.processAuthXMLRequest`,\n  which runs only after `AuthXMLRequest.parseXML` has already parsed the request\n  and instantiated the class named in the `<CustomCallback className=\"...\">`\n  element. Do not rely on it as a substitute for upgrading or for network\n  restriction.\n\n## Credit\nVulnerability discovered by Zhixi \"Jace\" Sun of ASM/VI at TikTok.\nCorrection of the interim mitigation guidance contributed by @BarakSrour.","published":"2026-07-24T21:11:09Z","modified":"2026-08-18T05:15:07.603071164Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Maven","name":"org.openidentityplatform.openam:openam-core","fixedVersion":"16.1.2"}],"fix":{"url":"https://github.com/OpenIdentityPlatform/OpenAM/commit/edcf968cad91a78b932dba4ad559ef94cbf35f5a","label":"OpenIdentityPlatform/OpenAM@edcf968"},"references":[{"type":"WEB","url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-wg5r-wc3x-39vc"},{"type":"WEB","url":"https://github.com/OpenIdentityPlatform/OpenAM/commit/edcf968cad91a78b932dba4ad559ef94cbf35f5a"},{"type":"PACKAGE","url":"https://github.com/OpenIdentityPlatform/OpenAM"},{"type":"WEB","url":"https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.2"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-18T05:15:07.603071164Z"}}