OpenAM WebAuthn Flaw Enables RCE Risk

A critical security vulnerability has been identified within the OpenAM authentication platform, specifically concerning its handling of WebAuthn data. Security researchers discovered that existing protective measures intended to constrain object deserialization failed to secure the full class graph, creating a pathway for potential exploitation.

Deserialization Filter Vulnerability

The issue stems from a previous attempt to harden the openam-auth-webauthn package against malicious input. While developers implemented an ObjectInputFilter designed to restrict deserialization to the AuthenticatorImpl class, the logic contains a technical oversight. When the Java serialization filter processes a data stream, it defaults to an ALLOWED status for any object once the stream depth exceeds 1.

Because the filter evaluates every class within the object graph, the restriction only effectively guards the root object. Any arbitrary gadget chain nested within the stream at a depth greater than 1 bypasses the intended allowlist entirely. This mechanism allows an attacker to craft a specialized stream that triggers unauthorized code execution during the readObject() phase.

Remote Execution Path

The vulnerability is particularly dangerous because the deserialization sink is accessible before the authentication process is completed. By providing an attacker-chosen userHandle, an external actor can reach the flawed code path without needing valid credentials. If a suitable gadget chain is present on the classpath, the application will execute the malicious logic before the system performs a cast or verifies any assertions.

• CVE Identifier: CVE-2026-62263
• Affected Package: maven/org.openidentityplatform.openam:openam-auth-webauthn
• Patched Version: 16.1.2

Security Update Requirements

The primary defense against this vulnerability is the application of the official patch provided by the maintainers. Users of the OpenAM ecosystem must ensure their implementations are updated to version 16.1.2 to remediate the logic flaw in the WebAuthn authenticator. Failure to update leaves the deserialization process open to manipulation by crafted input streams that leverage the identified depth-based bypass.