CVE-2026-62379

OpenAM (Open Access Management) versions before 16.1.2 allow the pre-authentication /authservice PLL endpoint to accept a CustomCallback XML element whose className attribute names an arbitrary Java class, which AuthXMLUtils loads and instantiates without verifying it implements DSAMECallbackInterface. Because default configurations expose this endpoint without authentication, a remote attacker can trigger attacker-controlled class initialization and unsafe deserialization of a serialized Subject value, achieving code execution in the server process. This affects any deployment running an OpenAM release prior to 16.1.2 where the endpoint is reachable, and enabling sunRemoteAuthSecurityEnabled does not help since that check occurs after the vulnerable parsing. The flaw is rated critical (CVSS 9.8, network vector, no privileges or user interaction required) and is fixed in version 16.1.2. No public proof of concept or confirmed in-the-wild exploitation is currently known, though the unauthenticated and straightforward trigger makes it highly attractive to attackers once discovered.

What to do: Upgrade to OpenAM 16.1.2 or later as soon as possible. Do not rely on enabling sunRemoteAuthSecurityEnabled — it does not prevent the vulnerable parsing and instantiation. Until patched, restrict access to the /authservice PLL endpoint (for example, block or limit it at a reverse proxy, WAF, or firewall to trusted partners only) and inspect logs for unauthenticated POST requests containing CustomCallback XML or serialized Subject data.