CVE-2026-62379: OpenAM Pre-Auth RCE Vulnerability

CVE-2026-62379 Overview

Open Access Management (OpenAM) contains an unauthenticated remote code execution vulnerability in the pre-authentication /authservice PLL endpoint. The endpoint accepts a CustomCallback XML element whose className value selects an arbitrary Java class. AuthXMLUtils loads and instantiates the class without verifying that it implements DSAMECallbackInterface. Default deployments expose the endpoint without authentication. Attackers can trigger unsafe deserialization of a serialized Subject value to execute code in the server process. Enabling sunRemoteAuthSecurityEnabled does not prevent exploitation because the check runs after the unsafe parsing. The issue is fixed in version 16.1.2.

Critical Impact

An unauthenticated network attacker can achieve remote code execution on the OpenAM server process, leading to full compromise of the identity and access management infrastructure.

Affected Products

• OpenIdentityPlatform OpenAM versions prior to 16.1.2
• Deployments exposing the /authservice PLL endpoint
• Default OpenAM configurations without additional network access controls

Discovery Timeline

• 2026-09-15 - CVE-2026-62379 published to the National Vulnerability Database (NVD)
• 2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-62379

Vulnerability Analysis

The flaw resides in AuthXMLUtils within the authentication share module. The class processes CustomCallback XML elements submitted to the pre-authentication /authservice PLL endpoint. It reads the className attribute and uses Java reflection to load and instantiate the specified class. The code omits a type check confirming the class implements DSAMECallbackInterface. This missing validation allows attackers to select arbitrary classes present on the server classpath. The endpoint additionally deserializes a Subject value from attacker-controlled input, enabling gadget-chain-based code execution. The classification maps to Improper Control of Generation of Code [CWE-94].

Root Cause

The root cause is missing type validation combined with insecure deserialization. AuthXMLUtils trusts the className value supplied in XML without confirming interface conformance before instantiation. The subsequent ObjectInputStream read of the serialized Subject executes with no object input filter. The intended safeguard sunRemoteAuthSecurityEnabled triggers too late in the request lifecycle. Parsing and instantiation complete before the security check runs, rendering the option ineffective.

Attack Vector

Remote attackers send a crafted XML request to the /authservice PLL endpoint over the network. No authentication or user interaction is required in default configurations. The XML payload references a gadget class available on the classpath and embeds a malicious serialized Subject. When the server deserializes the object, the gadget chain executes attacker-supplied commands in the OpenAM process context.

// Security patch in openam-core/src/main/java/com/sun/identity/authentication/share/AuthXMLUtils.java
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
+import java.io.ObjectInputFilter;
 import java.io.ObjectInputStream;
 import java.io.ObjectOutputStream;
 import java.security.AccessController;
+import java.security.Principal;
 import java.security.cert.CertificateEncodingException;
 import java.security.cert.CertificateException;
 import java.security.cert.CertificateFactory;

Source: OpenAM Security Patch Commit. The patch introduces ObjectInputFilter to constrain deserialization and adds Principal handling to enforce type expectations.

Detection Methods for CVE-2026-62379

Indicators of Compromise

• HTTP POST requests to /authservice containing CustomCallback XML elements with unusual className attribute values
• Java process spawning child processes such as shells, curl, wget, or scripting interpreters on OpenAM servers
• Outbound network connections from the OpenAM application server to previously unseen destinations following authentication requests
• Unexpected file writes or modifications under the OpenAM installation or temporary directories

Detection Strategies

• Inspect web server and reverse proxy logs for POST requests to /authservice with XML payloads referencing classes outside the standard com.sun.identity.authentication.spi namespace
• Monitor Java application logs for ClassNotFoundException, InvalidClassException, or reflection errors that indicate exploitation attempts
• Deploy web application firewall rules that block requests to /authservice containing serialized Java object magic bytes (aced 0005) in Base64-encoded form (rO0AB)

Monitoring Recommendations

• Enable process ancestry telemetry on OpenAM hosts to detect Java processes spawning unexpected child processes
• Alert on outbound network connections from OpenAM servers to non-approved destinations
• Track file integrity across the OpenAM web application directory and Java classpath locations

How to Mitigate CVE-2026-62379

Immediate Actions Required

• Upgrade OpenAM to version 16.1.2 or later, which enforces ObjectInputFilter and validates class types before instantiation
• Restrict network exposure of the /authservice PLL endpoint to trusted management networks using a reverse proxy or firewall
• Audit OpenAM servers for signs of exploitation, including anomalous processes, new files, and unexpected outbound connections
• Rotate credentials, session signing keys, and any secrets accessible to the OpenAM process after confirming remediation

Patch Information

OpenIdentity Platform released the fix in OpenAM Release 16.1.2. Technical details and coordinated disclosure information are documented in the GitHub Security Advisory GHSA-wg5r-wc3x-39vc. The patch modifies AuthXMLUtils to add a strict ObjectInputFilter and to enforce interface checks before instantiating callback classes.

Workarounds

• Block external access to /authservice at the reverse proxy or load balancer when upgrade cannot be applied immediately
• Note that toggling sunRemoteAuthSecurityEnabled does not mitigate the flaw because the vulnerable parsing occurs before the security check
• Remove or restrict classpath entries containing known deserialization gadget libraries where feasible

# Example nginx rule to block external access to the vulnerable endpoint
location /authservice {
    allow 10.0.0.0/8;      # trusted management network
    deny all;
    proxy_pass http://openam-backend;
}