Unauthenticated remote code execution in OpenAM /authservice endpoint (CVE-2026-62379)

OpenAM's remote authentication endpoint (`/authservice`, PLL) accepts an XML element naming an arbitrary Java class, which the server loads and instantiates without validation. This flaw is reachable without authentication on a default configuration, allowing a remote attacker to execute arbitrary code on the server. Successful exploitation results in full server compromise. Affected versions: - <= 16.1.1 We recommend updating to: 16.1.2. CVSS 9.8 · our assessment: act_now Reference: https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-wg5r-wc3x-39vc Details: https://vuln.today/cve/CVE-2026-62379