CVE-2026-62379

OpenAM (Open Identity Platform) prior to 16.1.2 contains a pre-authentication remote code execution flaw in the /authservice PLL endpoint. The AuthXMLUtils.createCustomCallback method loads and instantiates an arbitrary Java class named in a XML element without verifying it implements DSAMECallb...