Unauthenticated RCE in OpenAM via AuthXMLUtils.createCustomCallback (CVE-2026-62379)

What happened

The Open Identity Platform disclosed a pre-authentication remote code execution vulnerability in OpenAM, tracked as CVE-2026-62379 (CVSS 9.8), via GitHub Security Advisory GHSA-wg5r-wc3x-39vc. According to the advisory, the remote authentication endpoint /authservice (PLL protocol) accepts an XML element that names an arbitrary Java class, which the server then loads and instantiates via Class.forName inside AuthXMLUtils.createCustomCallback without validation. On a default configuration this endpoint is reachable without authentication, allowing an attacker to execute code on the server. The flaw affects all releases up to and including 16.1.1 and reportedly predates the Open Identity Platform fork of the original OpenAM codebase. A fix is available in 16.1.2, and a proof-of-concept is publicly available. The issue was credited to Zhixi "Jace" Sun of ASM/VI at TikTok.

Why it matters

OpenAM is an identity and access management / SSO platform, often deployed at the authentication perimeter for enterprise applications. A pre-auth deserialization-style class-loading flaw at that perimeter is about as severe as it gets: successful exploitation gives an attacker code execution on the identity server itself, with the potential to compromise every downstream application relying on it for authentication. Because no credentials are required and the vulnerable endpoint is exposed by default, any internet-facing or otherwise reachable OpenAM instance running an affected version should be treated as at immediate risk, especially now that a public PoC exists.

What defenders should do now

• Inventory OpenAM/Open Identity Platform deployments and confirm version — anything at or below 16.1.1 is affected.
• Prioritize upgrading to 16.1.2.
• If immediate patching isn't possible, enable sunRemoteAuthSecurityEnabled to require the remote-auth security token, which rejects unauthenticated /authservice calls.
• Restrict or block external/untrusted network access to /authservice until patched.
• Hunt for anomalous or malformed XML payloads to /authservice, especially requests referencing unexpected Java class names, and for unusual child-process spawning or outbound connections originating from the OpenAM server process.
• Review authentication and access logs around the PLL endpoint for spikes or requests from unfamiliar sources, particularly following public PoC availability.

Developing intel

This is a same-day advisory and details may evolve as the community and vendor publish further guidance. For the authoritative technical writeup, remediation steps, and credit, see the original GitHub Security Advisory: GHSA-wg5r-wc3x-39vc.