Vulnerability-Lookup

CVE-2026-62379 (GCVE-0-2026-62379)

Vulnerability from cvelistv5 – Published: 2026-09-15 09:45 – Updated: 2026-09-15 14:21

Title

OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

Summary

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, the pre-authentication /authservice PLL endpoint accepts a CustomCallback XML element whose className value selects an arbitrary Java class for AuthXMLUtils to load and instantiate without verifying that it implements DSAMECallbackInterface. Default configurations expose the endpoint without authentication, allowing attacker-controlled class initialization and unsafe deserialization of a serialized Subject value to execute code in the server process. Enabling sunRemoteAuthSecurityEnabled does not prevent the vulnerable parsing and instantiation because its check occurs later. This issue is fixed in version 16.1.2.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 14:21 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')
CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/OpenIdentityPlatform/OpenAM/se…	x_refsource_CONFIRM
https://github.com/OpenIdentityPlatform/OpenAM/co…	x_refsource_MISC
https://github.com/OpenIdentityPlatform/OpenAM/re…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
OpenIdentityPlatform	OpenAM	Affected: < 16.1.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-62379",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T14:21:15.614460Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T14:21:34.543Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OpenAM",
          "vendor": "OpenIdentityPlatform",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 16.1.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, the pre-authentication /authservice PLL endpoint accepts a CustomCallback XML element whose className value selects an arbitrary Java class for AuthXMLUtils to load and instantiate without verifying that it implements DSAMECallbackInterface. Default configurations expose the endpoint without authentication, allowing attacker-controlled class initialization and unsafe deserialization of a serialized Subject value to execute code in the server process. Enabling sunRemoteAuthSecurityEnabled does not prevent the vulnerable parsing and instantiation because its check occurs later. This issue is fixed in version 16.1.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-470",
              "description": "CWE-470: Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T09:45:52.152Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-wg5r-wc3x-39vc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-wg5r-wc3x-39vc"
        },
        {
          "name": "https://github.com/OpenIdentityPlatform/OpenAM/commit/edcf968cad91a78b932dba4ad559ef94cbf35f5a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OpenIdentityPlatform/OpenAM/commit/edcf968cad91a78b932dba4ad559ef94cbf35f5a"
        },
        {
          "name": "https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.2"
        }
      ],
      "source": {
        "advisory": "GHSA-wg5r-wc3x-39vc",
        "discovery": "UNKNOWN"
      },
      "title": "OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-62379",
    "datePublished": "2026-09-15T09:45:52.152Z",
    "dateReserved": "2026-07-13T22:04:59.678Z",
    "dateUpdated": "2026-09-15T14:21:34.543Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-62379",
      "date": "2026-09-15",
      "epss": "0.01089",
      "percentile": "0.63528"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-62379\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-09-15T10:17:06.107\",\"lastModified\":\"2026-09-15T15:17:20.270\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, the pre-authentication /authservice PLL endpoint accepts a CustomCallback XML element whose className value selects an arbitrary Java class for AuthXMLUtils to load and instantiate without verifying that it implements DSAMECallbackInterface. Default configurations expose the endpoint without authentication, allowing attacker-controlled class initialization and unsafe deserialization of a serialized Subject value to execute code in the server process. Enabling sunRemoteAuthSecurityEnabled does not prevent the vulnerable parsing and instantiation because its check occurs later. This issue is fixed in version 16.1.2.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"OpenIdentityPlatform\",\"product\":\"OpenAM\",\"versions\":[{\"version\":\"\u003c 16.1.2\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-15T14:21:15.614460Z\",\"id\":\"CVE-2026-62379\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-94\"},{\"lang\":\"en\",\"value\":\"CWE-470\"}]}],\"references\":[{\"url\":\"https://github.com/OpenIdentityPlatform/OpenAM/commit/edcf968cad91a78b932dba4ad559ef94cbf35f5a\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.2\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-wg5r-wc3x-39vc\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-62379\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-15T14:21:15.614460Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-15T14:21:22.303Z\"}}], \"cna\": {\"title\": \"OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback\", \"source\": {\"advisory\": \"GHSA-wg5r-wc3x-39vc\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"OpenIdentityPlatform\", \"product\": \"OpenAM\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 16.1.2\"}]}], \"references\": [{\"url\": \"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-wg5r-wc3x-39vc\", \"name\": \"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-wg5r-wc3x-39vc\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/OpenIdentityPlatform/OpenAM/commit/edcf968cad91a78b932dba4ad559ef94cbf35f5a\", \"name\": \"https://github.com/OpenIdentityPlatform/OpenAM/commit/edcf968cad91a78b932dba4ad559ef94cbf35f5a\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.2\", \"name\": \"https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.2\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, the pre-authentication /authservice PLL endpoint accepts a CustomCallback XML element whose className value selects an arbitrary Java class for AuthXMLUtils to load and instantiate without verifying that it implements DSAMECallbackInterface. Default configurations expose the endpoint without authentication, allowing attacker-controlled class initialization and unsafe deserialization of a serialized Subject value to execute code in the server process. Enabling sunRemoteAuthSecurityEnabled does not prevent the vulnerable parsing and instantiation because its check occurs later. This issue is fixed in version 16.1.2.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-94\", \"description\": \"CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-470\", \"description\": \"CWE-470: Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-09-15T09:45:52.152Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-62379\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-15T14:21:34.543Z\", \"dateReserved\": \"2026-07-13T22:04:59.678Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-09-15T09:45:52.152Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-62379

Vulnerability from fkie_nvd - Published: 2026-09-15 10:17 - Updated: 2026-09-15 15:17

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/OpenIdentityPlatform/OpenAM/commit/edcf968cad91a78b932dba4ad559ef94cbf35f5a
	security-advisories@github.com	https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.2
	security-advisories@github.com	https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-wg5r-wc3x-39vc

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "OpenAM",
          "vendor": "OpenIdentityPlatform",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 16.1.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, the pre-authentication /authservice PLL endpoint accepts a CustomCallback XML element whose className value selects an arbitrary Java class for AuthXMLUtils to load and instantiate without verifying that it implements DSAMECallbackInterface. Default configurations expose the endpoint without authentication, allowing attacker-controlled class initialization and unsafe deserialization of a serialized Subject value to execute code in the server process. Enabling sunRemoteAuthSecurityEnabled does not prevent the vulnerable parsing and instantiation because its check occurs later. This issue is fixed in version 16.1.2."
    }
  ],
  "id": "CVE-2026-62379",
  "lastModified": "2026-09-15T15:17:20.270",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-62379",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-15T14:21:15.614460Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-15T10:17:06.107",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/OpenIdentityPlatform/OpenAM/commit/edcf968cad91a78b932dba4ad559ef94cbf35f5a"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-wg5r-wc3x-39vc"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        },
        {
          "lang": "en",
          "value": "CWE-470"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-WG5R-WC3X-39VC

Vulnerability from github – Published: 2026-07-24 21:11 – Updated: 2026-08-03 20:44

Summary

OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

Details

Summary

A pre-authentication remote code execution vulnerability affects OpenAM. The remote authentication endpoint (/authservice, PLL) accepts an XML element that names an arbitrary Java class, which the server then loads and instantiates without validation. On a default configuration this is reachable without authentication and allows an attacker to run code on the server.

Impact

Unauthenticated remote code execution / full server compromise on any OpenAM instance with default settings.

Affected

All releases up to and including 16.1.1 (the defect predates the Open Identity Platform fork).

Remediation

Upgrade to 16.1.2. The fix resolves the class named in a <CustomCallback> element without running its static initialisers and rejects it unless it implements DSAMECallbackInterface, and it constrains deserialisation of the serialised Subject value to a class allowlist.

Interim mitigation

If you cannot upgrade immediately:

Restrict or block external network access to /authservice. This is the only reliable mitigation.
Optionally, block PLL requests carrying a <CustomCallback className="..."> element at the reverse proxy or WAF. That element is only produced for custom DSAMECallbackInterface callbacks, so most deployments never send it — confirm against your own traffic before enforcing.
Enabling sunRemoteAuthSecurityEnabled does not mitigate this issue. The remote-auth security token is checked in AuthXMLHandler.processAuthXMLRequest, which runs only after AuthXMLRequest.parseXML has already parsed the request and instantiated the class named in the <CustomCallback className="..."> element. Do not rely on it as a substitute for upgrading or for network restriction.

Credit

Vulnerability discovered by Zhixi "Jace" Sun of ASM/VI at TikTok. Correction of the interim mitigation guidance contributed by @BarakSrour.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 16.1.1"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.openidentityplatform.openam:openam-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "16.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-62379"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-470",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T21:11:09Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "## Summary\nA pre-authentication remote code execution vulnerability affects OpenAM. The\nremote authentication endpoint (`/authservice`, PLL) accepts an XML element\nthat names an arbitrary Java class, which the server then loads and\ninstantiates without validation. On a default configuration this is reachable\n**without authentication** and allows an attacker to run code on the server.\n\n## Impact\nUnauthenticated remote code execution / full server compromise on any OpenAM\ninstance with default settings.\n\n## Affected\nAll releases up to and including 16.1.1 (the defect predates the Open Identity\nPlatform fork).\n\n## Remediation\nUpgrade to `16.1.2`. The fix resolves the class named in a `\u003cCustomCallback\u003e`\nelement without running its static initialisers and rejects it unless it\nimplements `DSAMECallbackInterface`, and it constrains deserialisation of the\nserialised `Subject` value to a class allowlist.\n\n## Interim mitigation\nIf you cannot upgrade immediately:\n\n- **Restrict or block external network access to `/authservice`.** This is the\n  only reliable mitigation.\n- Optionally, **block PLL requests carrying a `\u003cCustomCallback className=\"...\"\u003e`\n  element** at the reverse proxy or WAF. That element is only produced for custom\n  `DSAMECallbackInterface` callbacks, so most deployments never send it \u2014 confirm\n  against your own traffic before enforcing.\n- **Enabling `sunRemoteAuthSecurityEnabled` does *not* mitigate this issue.** The\n  remote-auth security token is checked in `AuthXMLHandler.processAuthXMLRequest`,\n  which runs only after `AuthXMLRequest.parseXML` has already parsed the request\n  and instantiated the class named in the `\u003cCustomCallback className=\"...\"\u003e`\n  element. Do not rely on it as a substitute for upgrading or for network\n  restriction.\n\n## Credit\nVulnerability discovered by Zhixi \"Jace\" Sun of ASM/VI at TikTok.\nCorrection of the interim mitigation guidance contributed by @BarakSrour.",
  "id": "GHSA-wg5r-wc3x-39vc",
  "modified": "2026-08-03T20:44:06Z",
  "published": "2026-07-24T21:11:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-wg5r-wc3x-39vc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenIdentityPlatform/OpenAM/commit/edcf968cad91a78b932dba4ad559ef94cbf35f5a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/OpenIdentityPlatform/OpenAM"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-62379 (GCVE-0-2026-62379)

FKIE_CVE-2026-62379

GHSA-WG5R-WC3X-39VC

Summary

Impact

Affected

Remediation

Interim mitigation

Credit

Tags

Sightings

Nomenclature

Related by attack behaviour