OpenAM RCE Vulnerability Exposes Servers

A severe security vulnerability discovered in OpenAM has surfaced, creating a direct path for unauthenticated attackers to seize control of affected server environments. The flaw, identified as CVE-2026-62379, centers on the handling of specific XML elements within the authentication process, allowing for remote code execution without requiring prior access or credentials.

The Mechanism of Compromise

The vulnerability exists within the AuthXMLUtils.createCustomCallback function, which is reachable through the /authservice endpoint. In its default configuration, the OpenAM software accepts an XML element that specifies an arbitrary Java class. Because the server loads and instantiates this class without performing any validation, an attacker can craft a payload that results in the execution of unauthorized code on the host server.

Scope of the Security Flaw

This issue affects all releases of the software up to and including 16.1.1, a legacy defect that originated before the Open Identity Platform fork. The flaw carries a CVSS 9.8 severity rating, reflecting the ease of exploitation—specifically the fact that it is reachable without authentication—and the potential for full system compromise. The vulnerability was discovered by Zhixi "Jace" Sun of ASM/VI at TikTok.

Remediation and Mitigation Steps

To address the vulnerability, administrators are directed to upgrade their deployments to version 16.1.2. For those unable to patch immediately, the advisory suggests specific configuration changes to reduce exposure:

• Enable the sunRemoteAuthSecurityEnabled setting, which forces the requirement of a security token and rejects unauthenticated calls to the /authservice endpoint.
• Restrict or block external network access to the /authservice endpoint until the environment is fully patched.

Implications for Infrastructure Security

Because this vulnerability permits unauthenticated remote code execution, the potential for total server takeover on default installations is high. The reliance on unvalidated class loading at the authentication gateway highlights the risks associated with exposed service endpoints. Organizations utilizing OpenAM should prioritize the transition to the 16.1.2 release to eliminate the underlying code flaw, as temporary mitigations such as restricting network access only serve to minimize the attack surface until the primary vulnerability is resolved.