Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-62263

OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

CVSS 4.0 9.2 CRITICALCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-62263

Published

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, WebAuthnAuthentication.deserialize applies an ObjectInputFilter that allows every serialized object at depth greater than 1 and therefore constrains only an AuthenticatorImpl root object. A pre-authentication attacker can supply a userHandle whose serialized graph has a valid AuthenticatorImpl root and a nested gadget class, causing readObject or readResolve execution before the cast and assertion verification when a usable gadget is on the classpath. This bypasses the incomplete remediation for the earlier WebAuthn deserialization vulnerability. This issue is fixed in version 16.1.2.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-62263

Published

OpenAM

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "OpenIdentityPlatform",
                    "product": "OpenAM",
                    "versions": [
                        {
                            "version": "< 16.1.2",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON