{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 16.1.1"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.openidentityplatform.openam:openam-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "16.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-62379"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-470",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T21:11:09Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "## Summary\nA pre-authentication remote code execution vulnerability affects OpenAM. The\nremote authentication endpoint (`/authservice`, PLL) accepts an XML element\nthat names an arbitrary Java class, which the server then loads and\ninstantiates without validation. On a default configuration this is reachable\n**without authentication** and allows an attacker to run code on the server.\n\n## Impact\nUnauthenticated remote code execution / full server compromise on any OpenAM\ninstance with default settings.\n\n## Affected\nAll releases up to and including 16.1.1 (the defect predates the Open Identity\nPlatform fork).\n\n## Remediation\nUpgrade to `16.1.2`. The fix resolves the class named in a `\u003cCustomCallback\u003e`\nelement without running its static initialisers and rejects it unless it\nimplements `DSAMECallbackInterface`, and it constrains deserialisation of the\nserialised `Subject` value to a class allowlist.\n\n## Interim mitigation\nIf you cannot upgrade immediately:\n\n- **Restrict or block external network access to `/authservice`.** This is the\n  only reliable mitigation.\n- Optionally, **block PLL requests carrying a `\u003cCustomCallback className=\"...\"\u003e`\n  element** at the reverse proxy or WAF. That element is only produced for custom\n  `DSAMECallbackInterface` callbacks, so most deployments never send it \u2014 confirm\n  against your own traffic before enforcing.\n- **Enabling `sunRemoteAuthSecurityEnabled` does *not* mitigate this issue.** The\n  remote-auth security token is checked in `AuthXMLHandler.processAuthXMLRequest`,\n  which runs only after `AuthXMLRequest.parseXML` has already parsed the request\n  and instantiated the class named in the `\u003cCustomCallback className=\"...\"\u003e`\n  element. Do not rely on it as a substitute for upgrading or for network\n  restriction.\n\n## Credit\nVulnerability discovered by Zhixi \"Jace\" Sun of ASM/VI at TikTok.\nCorrection of the interim mitigation guidance contributed by @BarakSrour.",
  "id": "GHSA-wg5r-wc3x-39vc",
  "modified": "2026-08-03T20:44:06Z",
  "published": "2026-07-24T21:11:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-wg5r-wc3x-39vc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenIdentityPlatform/OpenAM/commit/edcf968cad91a78b932dba4ad559ef94cbf35f5a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/OpenIdentityPlatform/OpenAM"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback"
}