Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-62263: OpenAM permits remote code execution through WebAuthn deserialization

CVE-2026-62263 · published 17 days ago

Summary

Versions of OpenAM prior to 16.1.2 accept specially crafted authentication data that can cause the server to run arbitrary code. An attacker who can send a malicious user identifier could execute code on the system before normal checks occur. Upgrade to OpenAM 16.1.2 or later to eliminate this risk.

What to do

Update openidentityplatform org.openidentityplatform.openam:openam-auth-webauthn to version 16.1.2.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	openidentityplatform	openam	< 16.1.2
maven	openidentityplatform	org.openidentityplatform.openam:openam-auth-webauthn	<= 16.1.1 Fix: upgrade to 16.1.2
Maven	openidentityplatform	org.openidentityplatform.openam:openam-auth-webauthn	< 16.1.2 Fix: upgrade to 16.1.2
Ubuntu:16.04:LTS	canonical	openam	All versions

Original advisory text

OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, WebAuthnAuthentication.deserialize applies an ObjectInputFilter that allows every serialized object at depth greater than 1 and therefore constrains only an AuthenticatorImpl root object. A pre-authentication attacker can supply a userHandle whose serialized graph has a valid AuthenticatorImpl root and a nested gadget class, causing readObject or readResolve execution before the cast and assertion verification when a usable gadget is on the classpath. This bypasses the incomplete remediation for the earlier WebAuthn deserialization vulnerability. This issue is fixed in version 16.1.2.

References

https://github.com/advisories/GHSA-gf8h-gq53-288j
https://github.com/OpenIdentityPlatform/OpenAM Product
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62263... Vendor Advisory
https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.2 URL
https://nvd.nist.gov/vuln/detail/CVE-2026-62263 Vendor Advisory
https://github.com/OpenIdentityPlatform/OpenAM/commit/9dd0fbe07f70f118cf45042d3a... Patch
https://ubuntu.com/security/CVE-2026-62263 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-62263 Third Party Advisory
https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-gf8h-gq5... Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.9 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-502Deserialization of Untrusted Data

Timeline

Published15 Sep 2026

Updated1 Oct 2026

First seen24 Jul 2026

Sources

GHSA-gf8h-gq53-288j · GHSA

CVE-2026-62263 · NVD

GHSA-gf8h-gq53-288j · OSV

CVE-2026-62263 · MITRE

CVE-2026-62263 · OSV

UBUNTU-CVE-2026-62263 · OSV

Track software like this

Free during beta