Executive brief
OpenAM, an open-source access management solution, is vulnerable to a critical security flaw that allows attackers to take complete control of the server without needing a password. By sending a specially crafted request to the authentication service, an unauthorized user can run malicious code on the system. This could lead to the theft of sensitive user data, service disruption, or a total compromise of the corporate identity infrastructure.
Technical details
A remote code execution vulnerability exists in OpenAM's authentication endpoint (/authservice, PLL) due to unsafe use of Class.forName in the AuthXMLUtils.createCustomCallback method. The application accepts an XML element containing a class name and instantiates it without proper validation or sandboxing. Because this endpoint is reachable without authentication in default configurations, a remote attacker can trigger the loading and execution of arbitrary Java classes. This allows for full system compromise. The issue is addressed in version 16.1.2; interim mitigations include enabling sunRemoteAuthSecurityEnabled or restricting network access to the affected endpoint.
Affected products
- Open Identity Platform OpenAM <= 16.1.1
Timeline
- 2026-07-23: disclosed
- 2026-07-24: advisory: GHSA-wg5r-wc3x-39vc published
- 2026-07-23: patched: Version 16.1.2 released