CVE-2026-62379: Open Identity Platform OpenAM RCE in AuthXMLUtils

CVE-2026-62379 · Severity: critical · CVSS 9.8 · Published 2026-09-15

OpenAM, an open-source access management solution, is vulnerable to a critical security flaw that allows attackers to take complete control of the server without needing a password. By sending a specially crafted request to the authentication service, an unauthorized user can run malicious code on the system. This could lead to the theft of sensitive user data, service disruption, or a total compromise of the corporate identity infrastructure.

Technologies: org.openidentityplatform.openam:openam-core (Maven), Open Identity Platform OpenAM. Vendors: Maven, Open Identity Platform.

Quick answers

Is CVE-2026-62379 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-62379 being exploited in the wild.
How severe is CVE-2026-62379?
Critical severity, with a CVSS score of 9.8, published 15 September 2026.
Which products and versions are affected?
org.openidentityplatform.openam:openam-core (Maven) <= 16.1.1, ECOSYSTEM:introduced=0,fixed=16.1.2; Open Identity Platform OpenAM <= 16.1.1.
Is there a fix for CVE-2026-62379?
Yes. org.openidentityplatform.openam:openam-core (Maven): upgrade to 16.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62379 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-62379?
Check whether you run org.openidentityplatform.openam:openam-core (Maven) or Open Identity Platform OpenAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.openidentityplatform.openam:openam-core (Maven): upgrade to 16.1.2 or later
    # set org.openidentityplatform.openam:openam-core to 16.1.2 in your pom.xml or build.gradle

Technical details

A remote code execution vulnerability exists in OpenAM's authentication endpoint (/authservice, PLL) due to unsafe use of Class.forName in the AuthXMLUtils.createCustomCallback method. The application accepts an XML element containing a class name and instantiates it without proper validation or sandboxing. Because this endpoint is reachable without authentication in default configurations, a remote attacker can trigger the loading and execution of arbitrary Java classes. This allows for full system compromise. The issue is addressed in version 16.1.2; interim mitigations include enabling sunRemoteAuthSecurityEnabled or restricting network access to the affected endpoint.

Affected products

  • Open Identity Platform OpenAM <= 16.1.1

Identifiers

  • CVE-2026-62379
  • GHSA-wg5r-wc3x-39vc

Timeline

  • 2026-07-23: disclosed
  • 2026-07-24: advisory: GHSA-wg5r-wc3x-39vc published
  • 2026-07-23: patched: Version 16.1.2 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.