Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, the pre-authentication /authservice PLL endpoint accepts a CustomCallback XML element whose className value selects an arbitrary Java class for AuthXMLUtils to load and instantiate without verifying that it implements DSAMECallbackInterface. Default configurations expose the endpoint without authentication, allowing attacker-controlled class initialization and unsafe deserialization of a serialized Subject value t

A critical remote code execution vulnerability (CVE-2026-62379) exists in Open Access Management (OpenAM) prior to version 16.1.2. The /authservice PLL endpoint accepts a CustomCallback XML element with an arbitrary className value, allowing attackers to load and instantiate any Java class without verifying it implements DSAMECallbackInterface. Default configurations expose this endpoint without authentication, enabling attacker-controlled class initialization and unsafe deserialization of a serialized Subject value. This can result in arbitrary code execution within the server process. The security control sunRemoteAuthSecurityEnabled does not mitigate the issue as its check occurs after the vulnerable parsing and instantiation steps. The vulnerability has been patched in OpenAM version 16.1.2. Users are strongly advised to upgrade immediately to mitigate risk of exploitation.