Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.2
CVE-2026-62263: OpenAM: WebAuthn Java Deserialization Allows Remote Code Execution
GHSA-gf8h-gq53-288j
CVE-2026-62263
GHSA-gf8h-gq53-288j
Summary
OpenAM's WebAuthn feature has a security issue that allows an attacker to run malicious code on the system. This is because OpenAM doesn't properly check the data it receives from users, allowing an attacker to inject code that can be executed remotely. To fix this, update OpenAM to the latest version to ensure you have the necessary security patches in place.
What to do
- Update org.openidentityplatform.openam:openam-auth-webauthn to version 16.1.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | – | org.openidentityplatform.openam:openam-auth-webauthn |
<= 16.1.1 Fix: upgrade to 16.1.2
|
| Maven | – | org.openidentityplatform.openam:openam-auth-webauthn |
< 16.1.2 Fix: upgrade to 16.1.2
|
Original title
OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass
Original description
### Summary
The GHSA-6c99-87fr-6q7r fix wrapped WebAuthn authenticator deserialization in an `ObjectInputFilter` meant to allow only `AuthenticatorImpl`, but it short-circuits to `ALLOWED` for any object at stream `depth > 1`. Because the Java serialization filter is consulted for every class in the graph (and `depth == 1` only for the root's concrete class), the allowlist constrains only the root and leaves the entire nested graph unchecked.
### Impact
An attacker can craft a stream rooted at `AuthenticatorImpl` with an arbitrary gadget chain nested inside. The gadget's `readObject`/`readResolve` executes during `readObject()` — before the cast and before any assertion verification — enabling remote code execution when a gadget is on the classpath. The deserialization sink is reached pre-authentication via an attacker-chosen `userHandle`.
The GHSA-6c99-87fr-6q7r fix wrapped WebAuthn authenticator deserialization in an `ObjectInputFilter` meant to allow only `AuthenticatorImpl`, but it short-circuits to `ALLOWED` for any object at stream `depth > 1`. Because the Java serialization filter is consulted for every class in the graph (and `depth == 1` only for the root's concrete class), the allowlist constrains only the root and leaves the entire nested graph unchecked.
### Impact
An attacker can craft a stream rooted at `AuthenticatorImpl` with an arbitrary gadget chain nested inside. The gadget's `readObject`/`readResolve` executes during `readObject()` — before the cast and before any assertion verification — enabling remote code execution when a gadget is on the classpath. The deserialization sink is reached pre-authentication via an attacker-chosen `userHandle`.
ghsa CVSS4.0
9.2
Vulnerability type
CWE-502
Deserialization of Untrusted Data
- https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-gf8h-gq5...
- https://github.com/OpenIdentityPlatform/OpenAM/commit/9dd0fbe07f70f118cf45042d3a...
- https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.2
- https://github.com/advisories/GHSA-gf8h-gq53-288j
- https://github.com/OpenIdentityPlatform/OpenAM Product
Published: 24 Jul 2026 · Updated: 24 Jul 2026 · First seen: 24 Jul 2026