A pre-authentication remote code execution vulnerability affects OpenAM. The remote authentication endpoint ("/authservice", PLL) accepts an XML element that names an arbitrary Java class, which the server then loads and instantiates without validation. On a default configuration this is reachable without authentication and allows an attacker to run code on the server.