Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M
CVE-2026-45794OpenAM Unsafe Java Deserialization via SNS
High 7.7
In plain English
A high-severity unsafe deserialization in OpenAM from OpenIdentityPlatform. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the anonymous Push Notification SNS callback handled by SnsMessageResource falls back to a CTS predicate blob after a messageId expires from the in-memory dispatcher, treats top-level blob keys as Java class names for Class.forName, and deserializes attacker-controlled JSON through Jackson. A low-privileged user who starts Push Registration and obtains the messageId, shared secret, and challenge can wait for expiry, replace the persistent blob through anonymous callbacks, and trigger class loading and construction in the OpenAM JVM. The primitive can cause classpath-dependent process execution, file writes, or denial of service, although command execution was not confirmed on the tested stock classpath. This issue is fixed in version 16.1.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.openidentityplatform.openam:openam-push-notification | 16.1.1 | GHSA-pp89-732f-3g8q |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OpenIdentityPlatform | OpenAM | < 16.1.1 |
Weakness: CWE-502 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-pp89-732f-3g8q x_refsource_CONFIRM
- https://github.com/OpenIdentityPlatform/OpenAM/commit/ca15cba9210f17c0f839b1c148964e1a3dc4a8ca x_refsource_MISC
- https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1 x_refsource_MISC