Product
An unauthenticated remote code execution vulnerability, tracked as CVE-2026-62379, affects OpenAM up to and including version 16.1.1, allowing attackers to achieve full server compromise by sending a crafted XML element to the `/authservice` endpoint that names and instantiates an arbitrary Java class without validation on default configurations.