by Kastro
Paper/Archive/CVE-2026-62263

CVE-2026-62263

OpenIdentityPlatform OpenAM — OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

EPSS 0.9%CVSS 9.2
critical.is priorityof 100
39
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 58.5.585 × 2011.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, WebAuthnAuthentication.deserialize applies an ObjectInputFilter that allows every serialized object at depth greater than 1 and therefore constrains only an AuthenticatorImpl root object. A pre-authentication attacker can supply a userHandle whose serialized graph has a valid AuthenticatorImpl root and a nested gadget class, causing readObject or readResolve execution before the cast and assertion verification when a usable gadget is on the classpath. This bypasses the incomplete remediation for the earlier WebAuthn deserialization vulnerability. This issue is fixed in version 16.1.2.

Affected

ProductAffectedFixed inSource
OpenAM< 16.1.2–CNA

Scores by source

GitHub_M (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-gf8h-gq53-288jrefgithub.com/OpenIdentityPlatform/OpenAM/commit/9dd0fbe07f70f118cf45042d3a9ffb32f3c21e08refgithub.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.2