CVE-2026-62263 — Vulnerability in...

CRITICAL

OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

Published July 24, 2026Updated July 24, 2026Source: osv

Summary

### Summary The GHSA-6c99-87fr-6q7r fix wrapped WebAuthn authenticator deserialization in an `ObjectInputFilter` meant to allow only `AuthenticatorImpl`, but it short-circuits to `ALLOWED` for any object at stream `depth > 1`. Because the Java serialization filter is consulted for every class in the graph (and `depth == 1` only for the root's concrete class), the allowlist constrains only the root and leaves the entire nested graph unchecked. ### Impact An attacker can craft a stream rooted at `AuthenticatorImpl` with an arbitrary gadget chain nested inside. The gadget's `readObject`/`readResolve` executes during `readObject()` — before the cast and before any assertion verification — enabling remote code execution when a gadget is on the classpath. The deserialization sink is reached pre-authentication via an attacker-chosen `userHandle`.

Advisory Timeline

First published July 24, 2026 (80 days ago).
Last revised July 24, 2026 — 0 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven

Update org.openidentityplatform.openam:openam-auth-webauthn to 16.1.2 or later

<!-- Update pom.xml dependency version to 16.1.2 for org.openidentityplatform.openam:openam-auth-webauthn -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: maven (1).

Package	Ecosystem	Affected	Fixed In
org.openidentityplatform.openam:openam-auth-webauthn	maven	14.5.2, 14.5.3, 14.5.4, 14.6.1 (+37 more)	16.1.2

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-502
Deserialization of Untrusted DataMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.3 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

—

Confidentiality

—

Integrity

—

Availability

—

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

Frequently Asked Questions

What is CVE-2026-62263?: OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.3/10).
How do I check if my project is affected by CVE-2026-62263?: CVE-2026-62263 affects org.openidentityplatform.openam:openam-auth-webauthn. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-62263 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.3

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-gf8h-gq53-288j

Related CVEs

CVE-2026-33439
CRITICAL
OpenIdentityPlatform OpenAM: Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM
CVE-2026-45051
CRITICAL
OpenAM: Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage
CVE-2026-44203
CRITICAL
OpenAM has pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)
CVE-2026-45052
CRITICAL
OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints
CVE-2026-62379
CRITICAL
OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback
CVE-2025-64099
HIGH
OpenAM: Using arbitrary OIDC requested claims values in id_token and user_info is allowed
CVE-2026-45794
HIGH
OpenAM has Unsafe Java Deserialization via SNS
CVE-2026-45048
HIGH
OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies