CVE-2026-62379: OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

A pre-authentication remote code execution vulnerability affects OpenAM. The remote authentication endpoint (/authservice, PLL) accepts an XML element that names an arbitrary Java class, which the server then loads and instantiates without validation. On a default configuration this is reachable without authentication and allows an attacker to run code on the server.