CVE-2026-62379

OpenAM (Open Identity Platform) prior to 16.1.2 contains a pre-authentication remote code execution flaw in the /authservice PLL endpoint. The AuthXMLUtils.createCustomCallback method loads and instantiates an arbitrary Java class named in a XML element without verifying it implements DSAMECallb...

CVE-2026-62379: Improper Control of Generation of Code

Open Access Management OpenAM is an access management solution. Prior to 16.1.2, the pre-authentication /authservice PLL endpoint accepts a CustomCallback XML element whose className value selects an arbitrary Java class for AuthXMLUtils to load and instantiate without verifying that it implement...