CVE-2026-62379 is a critical pre-authentication remote code execution vulnerability in OpenAM's remote authentication endpoint (/authservice). The endpoint processes an XML element that names a Java class, which the server loads and instantiates without validation or restriction. This flaw allows unauthenticated attackers to execute arbitrary code on the server. The vulnerability affects all OpenAM releases up to and including 16.1.1. The fix in 16.1.2 prevents execution of static initializers for the named class, rejects classes not implementing DSAMECallbackInterface, and restricts deserialization to an allowlist of classes. Interim mitigations include network restrictions and blocking specific XML elements at the proxy level. The vulnerability has a CVSS 3.1 score of 9.8, indicating critical severity.

An attacker can achieve unauthenticated remote code execution on any vulnerable OpenAM instance with default settings, potentially leading to full server compromise. This allows complete control over the affected system without requiring any authentication.

A fix is available in OpenAM version 16.1.2 and upgrading to this version is the recommended remediation. Until an upgrade can be performed, restrict or block external network access to the /authservice endpoint. Additionally, block requests containing the <CustomCallback className="..."> element at the reverse proxy or WAF, after confirming this does not disrupt legitimate traffic. Do not rely on enabling sunRemoteAuthSecurityEnabled as it does not mitigate this vulnerability.