CVE-2026-62379
Summary
A pre-authentication remote code execution vulnerability affects OpenAM. The
remote authentication endpoint (/authservice, PLL) accepts an XML element
that names an arbitrary Java class, which the server then loads and
instantiates without validation. On a default configuration this is reachable
without authentication and allows an attacker to run code on the server.
Impact
Unauthenticated remote code execution / full server compromise on any OpenAM
instance with default settings.
Affected
All releases up to and including 16.1.1 (the defect predates the Open Identity
Platform fork).
Remediation
Upgrade to 16.1.2.
Interim mitigation
- Require the remote-auth security token by enabling
sunRemoteAuthSecurityEnabled (rejects unauthenticated /authservice calls).
- Restrict or block external network access to /authservice until patched.
Credit
Vulnerability discovered by Zhixi "Jace" Sun of ASM/VI at TikTok.
⚡ Watch CVE-2026-62379
Get an email if CVE-2026-62379 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Advisory coverage (1)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-62379)