OpenAM CVE-2026-62379 (CVSS 9.8) Enables Unauthenticated Remote Code Execution, CVE-2026-62261 Scores CVSS 9.9
Do Son 
TL;DR
OpenAM 16.1.2 patches four security flaws in the open-source access management server. Three of these OpenAM vulnerabilities lead to remote code execution. The worst, CVE-2026-62379, allows unauthenticated code execution on a default install and scores a CVSS of 9.8.
Why It Matters
OpenAM runs authentication, single sign-on, and authorization for many organizations. It fronts web, cloud, and legacy apps. So code execution on that server hands an attacker the keys to every identity it protects. Two of these flaws need no login at all.
How the Attacks Work
Unauthenticated RCE via /authservice (CVSS 9.8)
CVE-2026-62379 is the standout risk. The remote authentication endpoint accepts an XML element that names any Java class. The server then loads and instantiates that class with no validation. On a default configuration, this path is reachable without authentication, which opens the door to full server compromise.
Groovy sandbox escape (CVSS 9.9)
CVE-2026-62261 turns script access into code execution. OpenAM sandboxes Groovy at runtime only. However, compile-time annotations run during compilation, before the sandbox applies. Merely validating a script triggers execution. Any authenticated user with script rights in any realm can therefore run OS commands.
WebAuthn deserialization and stored SSRF
CVE-2026-62263 (CVSS 9.2) is a pre-authentication deserialization flaw. A filter meant to allow one class checks only the root object, so a nested gadget chain slips through. CVE-2026-63463 (CVSS 7.3) lets an unauthenticated attacker register a callback URL through the legacy JAXRPC endpoint. OpenAM then fires a server-side request to it on every config change, a stored SSRF.
Exploitation Status
The maintainers documented all four issues in their GitHub security advisories. No exploitation in the wild has been confirmed, and no public proof-of-concept exists at this time.
Affected Versions
Every OpenAM release up to and including 16.1.1 is affected. The unauthenticated RCE predates the Open Identity Platform fork. Version 16.1.2 contains the fixes.
Patch and Mitigation Steps
Upgrade to OpenAM 16.1.2 right away. Given the unauthenticated RCE, treat this as an emergency change.
Some interim steps cut exposure first. Enable sunRemoteAuthSecurityEnabled to reject unauthenticated /authservice calls, and block external access to that endpoint. Restrict /jaxrpc/* at the reverse proxy, and apply egress filtering on outbound HTTP from the host. Finally, limit who holds Groovy script validate or create rights across all realms.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
