Vulnerability Description
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, WebAuthnAuthentication.deserialize applies an ObjectInputFilter that allows every serialized object at depth greater than 1 and therefore constrains only an AuthenticatorImpl root object. A pre-authentication attacker can supply a userHandle whose serialized graph has a valid AuthenticatorImpl root and a nested gadget class, causing readObject or readResolve execution before the cast and assertion verification when a usable gadget is on the classpath. This bypasses the incomplete remediation for the earlier WebAuthn deserialization vulnerability. This issue is fixed in version 16.1.2.
Related Weaknesses (CWE)
References
- https://github.com/OpenIdentityPlatform/OpenAM/commit/9dd0fbe07f70f118cf45042d3a
- https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.2
- https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-gf8h-gq5
FAQ
What is CVE-2026-62263?
CVE-2026-62263 is a documented vulnerability. Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, WebAuthnAuthentication.deserialize applies an ObjectInputFilter that allows every serialized object at depth greater ...
How severe is CVE-2026-62263?
CVSS scoring is not yet available for CVE-2026-62263. Check NVD for updates.
Is there a patch for CVE-2026-62263?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.