Critical OpenAM RCE Flaw Allows Server Takeover

A critical remote code execution vulnerability, tracked as CVE-2026-62379, affects OpenAM. The flaw exists within the AuthXMLUtils.createCustomCallback function, allowing unauthenticated attackers to trigger arbitrary Java class loading and instantiation via the /authservice endpoint.

Because this vulnerability is reachable without authentication in default configurations, it poses a severe risk of complete server compromise. The flaw impacts all releases of OpenAM up to and including version 16.1.1.

What's at Risk

The affected component is maven/org.openidentityplatform.openam:openam-core. Any organization running OpenAM versions 16.1.1 or earlier is exposed to this vulnerability. Systems that are internet-facing and utilize the default authentication configuration are at the highest risk, as they provide an accessible attack surface for remote exploitation.

In general, identity and access management systems are high-value targets for attackers. When an authentication service is compromised, it can lead to unauthorized access to downstream applications, the exposure of sensitive user credentials, and the potential for lateral movement across an enterprise network.

How the Flaw Works

This vulnerability stems from insecure handling of input that directs the application to load and instantiate classes. When software takes user-supplied input to determine which object or class to initialize without strict validation or allow-listing, it creates a dangerous entry point for attackers. This is a common class of vulnerability where an application fails to properly sanitize input used in dynamic class loading.

Generally, this type of flaw allows an attacker to force the application to execute arbitrary code with the same privileges as the application process itself. By supplying a crafted XML payload, an attacker can manipulate the server into executing malicious commands. This bypasses typical authentication controls, as the code execution occurs during the processing of the authentication request itself, before the user is verified.

How to Protect Your Systems

• Upgrade your OpenAM installation to version 16.1.2 immediately to patch the vulnerable code.
• Enable the sunRemoteAuthSecurityEnabled setting to require a remote-auth security token, which rejects unauthenticated calls to the /authservice endpoint.
• Restrict or block external network access to the /authservice endpoint at your firewall or load balancer until the patch is applied.
• Regularly monitor server and application logs for unexpected or unauthorized requests to authentication endpoints.
• Follow established vendor hardening guides to ensure that unnecessary services and endpoints are disabled or segmented from the public internet.

The severity of this vulnerability, rated at 9.8 on the CVSS scale, highlights the necessity of immediate action. Unauthenticated remote code execution flaws are frequently targeted by attackers due to the ease of exploitation and the depth of access they provide. Patching affected systems promptly is the most effective way to eliminate the risk posed by this specific vulnerability.