Open Access Management (OpenAM) is an access management solution. (CVE-2026-62379)
Affects openamSource GCVE Database
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 1.0% chance of exploitation in 30 days – higher than 64% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 16.1.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Mavenorg.openidentityplatform.openam:openam-core | Affected
| Fixed in
|
Ubuntu:16.04:LTSopenampkg:deb/ubuntu/openam?arch=source&distro=xenialOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade OpenAM to version 16.1.2 or later, where this vulnerability is fixed. Until then, restrict access to the /authservice PLL endpoint to trusted users only, as the default configuration exposes it without authentication. Note that enabling sunRemoteAuthSecurityEnabled does not prevent exploitation. Monitor vendor advisories for any additional mitigation guidance.
Description
Open Access Management (OpenAM) versions prior to 16.1.2 contain a critical vulnerability in the pre-authentication /authservice PLL endpoint. This endpoint accepts a CustomCallback XML element that allows an attacker to specify an arbitrary Java class for instantiation without verifying interface implementation. The default configuration exposes this endpoint without authentication, enabling unsafe deserialization and remote code execution on the server. The vulnerability is fixed in version 16.1.2.
Impact
Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on the server running OpenAM by leveraging unsafe deserialization and arbitrary class instantiation. This can lead to full compromise of the affected system. The vulnerability has a CVSS 3.1 score of 9.8, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.
Summary
CVE-2026-62379 affects OpenAM prior to version 16.1.2. The pre-authentication /authservice PLL endpoint accepts a CustomCallback XML element whose className value is used by AuthXMLUtils to load and instantiate a Java class without verifying it implements DSAMECallbackInterface. Because the endpoint is exposed by default without authentication, an attacker can supply a malicious class to trigger unsafe deserialization of a serialized Subject value, leading to remote code execution in the server process. The sunRemoteAuthSecurityEnabled setting does not mitigate this vulnerability as its check occurs after the unsafe parsing and instantiation. The issue is resolved in OpenAM version 16.1.2.
Weaknesses
References
- github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-wg5r-wc3x-39vc (opens in a new tab)
- github.com/OpenIdentityPlatform/OpenAM/commit/edcf968cad91a78b932dba4ad559ef94cbf35f5a (opens in a new tab)
- github.com/OpenIdentityPlatform/OpenAM (opens in a new tab)
- github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.2 (opens in a new tab)
- ubuntu.com/security/CVE-2026-62379 (opens in a new tab)
- cve.org/CVERecord?id=CVE-2026-62379 (opens in a new tab)