CVE-2026-62379: OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback
(updated )
A pre-authentication remote code execution vulnerability affects OpenAM. The
remote authentication endpoint (/authservice, PLL) accepts an XML element
that names an arbitrary Java class, which the server then loads and
instantiates without validation. On a default configuration this is reachable
without authentication and allows an attacker to run code on the server.
References
- github.com/OpenIdentityPlatform/OpenAM/commit/edcf968cad91a78b932dba4ad559ef94cbf35f5a
- github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.2
- github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-wg5r-wc3x-39vc
- github.com/advisories/GHSA-wg5r-wc3x-39vc
- nvd.nist.gov/vuln/detail/CVE-2026-62379
Code Behaviors & Features
Detect and mitigate CVE-2026-62379 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →