CVE-2026-62379: OpenAM Pre-Auth RCE via Unsafe Reflection, CVSS 9.8

Open-source IAM platform OpenAM disclosed CVE-2026-62379, a pre-auth RCE at CVSS v3.1 9.8. The /authservice endpoint uses Class.forName to load attacker-controlled Java classes. No credentials are required on default config. Affects 16.1.1 and earlier; fixed in 16.1.2.

On 24 July 2026, Open Identity Platform disclosed a pre-authentication remote code execution flaw in the open-source identity and access management (IAM) platform OpenAM. Tracked as CVE-2026-62379, it scores CVSS v3.1 9.8 (Critical). The bug sits on the `/authservice` remote authentication endpoint: server-side XML parsing uses `Class.forName()` to reflectively load an attacker-controlled Java class name. On default config, any anonymous attacker who can reach the endpoint can trigger code execution with no credentials. The issue was found and reported by Zhixi Jace Sun of ByteDance's ASM/VI team.

1. Incident Overview

OpenAM (formerly Sun OpenAM / ForgeRock OpenAM) is a widely deployed open-source SSO, OAuth 2.0, OIDC, and identity-federation component. It owns enterprise SSO, authorization, and session management. This bug breaks the anonymous-to-authenticated boundary, so any app that relies on OpenAM for identity is high-risk on default config.

• ID: CVE-2026-62379 (GitHub Advisory: GHSA-wg5r-wc3x-39vc)
• Component: `org.openidentityplatform.openam:openam-core`
• Affected: <= 16.1.1 (the defect predates the Open Identity Platform fork)
• Fixed: 16.1.2
• Disclosed: 2026-07-24 / attack surface: reachable without auth on default config

2. Technical Details

Root cause is CWE-470 Use of Externally-Controlled Input to Select Classes or Code (unsafe reflection), with CWE-94 dynamic code injection. Trigger chain:

• The client posts an XML payload to OpenAM's `/authservice` (PLL) remote auth endpoint. The XML carries an element attribute that can name any Java fully-qualified class.
• `AuthXMLUtils.createCustomCallback()` parses that element, takes the `class` attribute, and calls `Class.forName(className).newInstance()`.
• There is no allowlist or context check before load/instantiate. Attackers can point at any class on the classpath.
• Default config leaves remote-auth security tokens off (`sunRemoteAuthSecurityEnabled=false`), so the path needs no authentication.
• Once the remote class is instantiated, its constructor or init runs arbitrary Java at the OpenAM service process privilege — RCE.

Fix commit `edcf968` adds an explicit callback-class allowlist before `Class.forName`. Names not on the list are rejected at parse time and the reflection chain is cut. The fix is in the XML parser, so even a pre-auth context cannot bypass it.

3. Impact Assessment

CVSS 3.1 vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` takes the worst value on all eight dimensions: network-reachable, low complexity, no privileges, no user interaction, full C/I/A impact. EPSS currently predicts 0% chance of in-the-wild use in 30 days (early after disclosure), but given:

• Technical details are public in the GitHub Security Advisory and NVD;
• OpenAM is widely deployed in finance, telecom, and government IAM stacks;
• The delta between 16.1.2 and 16.1.1 is small, so attackers can patch-diff the fix quickly;

public PoCs or exploit attempts are expected within 2–3 weeks. A fallen OpenAM instance hands over every downstream system that authenticates through it (OA, ticketing, HR, mail, cloud consoles). Blast radius scales exponentially.

4. Remediation

4.1 Patch now

• Upgrade `openam-core` to 16.1.2 and follow the Open Identity Platform upgrade process.
• Restart every OpenAM instance and confirm the version on the `about` page.

4.2 Temporary mitigations (if you cannot upgrade yet)

• Enable remote-auth security tokens: `sunRemoteAuthSecurityEnabled=true`. All `/authservice` calls then require a token; tokenless requests are rejected, cutting the anonymous path.
• Restrict source IPs to `/authservice` on the border firewall/WAF. Allow only trusted internal networks or a controlled auth proxy.
• Hunt OpenAM access logs for abnormal XML on `/authservice` (`class` attributes, suspicious Java class names) and temporarily block matching source IPs.
• If the instance is internet-exposed, put OpenAM in maintenance mode (internal auth only) to cut remote exploit paths.

4.3 Hardening

• Audit credentials on every downstream system that authenticates via OpenAM. Rotate keys and client credentials as needed.
• Deploy RASP or WAF rules that block suspicious reflection paths calling `Class.forName`.
• Subscribe to Open Identity Platform GitHub Security Advisories. Land critical patches within 72 hours.

5. References

• GitHub Security Advisory: https://github.com/advisories/GHSA-wg5r-wc3x-39vc
• OpenAM fix commit: https://github.com/OpenIdentityPlatform/OpenAM/commit/edcf968
• 16.1.2 release: https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.2
• SecureLayer7 analysis: https://securelayer7.net/lab/cve-2026-62379-openam-authxmlutils-unsafe-reflection-rce