Remote Code Execution Vulnerability in Open Access Management by OpenIdentityPlatform

CVE-2026-62379

What is CVE-2026-62379?

Open Access Management (OpenAM) has a vulnerability that allows attackers to exploit the pre-authentication /authservice PLL endpoint. The endpoint accepts a CustomCallback XML element, allowing an attacker to specify a className that can result in the loading and instantiation of arbitrary Java classes. This occurs without validating if the selected class implements the necessary interface, leading to unsafe deserialization of a serialized Subject value which can result in code execution within the server process. The default configuration exposes this endpoint without any authentication measures, making it more susceptible to attacks. Although enabling sunRemoteAuthSecurityEnabled is an option, it does not mitigate the issue since its validation is processed at a later stage. The vulnerability was effectively addressed in version 16.1.2.

References