Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M

CVE-2026-62263OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

Critical 9.2

In plain English

A critical-severity unsafe deserialization in OpenAM from OpenIdentityPlatform. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)9.2Critical

Exploit odds (30 days)0.9%top 41.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, WebAuthnAuthentication.deserialize applies an ObjectInputFilter that allows every serialized object at depth greater than 1 and therefore constrains only an AuthenticatorImpl root object. A pre-authentication attacker can supply a userHandle whose serialized graph has a valid AuthenticatorImpl root and a nested gadget class, causing readObject or readResolve execution before the cast and assertion verification when a usable gadget is on the classpath. This bypasses the incomplete remediation for the earlier WebAuthn deserialization vulnerability. This issue is fixed in version 16.1.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.openidentityplatform.openam:openam-auth-webauthn	16.1.2	GHSA-gf8h-gq53-288j

Affected products (as reported)

Vendor	Product	Versions
OpenIdentityPlatform	OpenAM	< 16.1.2

Weakness: CWE-502 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-gf8h-gq53-288j x_refsource_CONFIRM
https://github.com/OpenIdentityPlatform/OpenAM/commit/9dd0fbe07f70f118cf45042d3a9ffb32f3c21e08 x_refsource_MISC
https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.2 x_refsource_MISC