CVE-2026-45051
Received Received - Intake

Authentication Bypass via Deserialization in OpenAM

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, WebAuthnAuthentication loads a serialized AuthenticatorImpl object graph from the configured userAttribute through loadAuthenticators without an ObjectInputFilter. Exploitation requires the WebAuthn flow to be reachable and an attacker to have previously written controlled data to that attribute through delegated administration, provisioning, directory access, legacy REST self-registration, or unsafe configuration. When those non-default conditions hold, the data is deserialized before assertion verification and can execute a classpath gadget in the application server process. This issue is fixed in version 16.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-45051
EUVD
EUVD-2026-78363

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
forgerock openam 16.1.1
openidentityplatform openam 16.1.1
openidentityplatform openam to 16.0.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-45051 is a Java deserialization vulnerability in OpenAM's WebAuthn authentication module. It allows unauthenticated remote code execution (RCE) when malicious data is deserialized from a user-controlled attribute during the WebAuthn flow. The issue occurs because the application deserializes untrusted data without proper validation, enabling attackers to execute arbitrary code in the application server process.

Detection Guidance

Detecting this vulnerability requires checking if your OpenAM instance is running a vulnerable version (prior to 16.1.1) and if the WebAuthn authentication flow is enabled with user-writable attributes. Inspect the OpenAM version and configuration files for WebAuthn settings. No specific commands are provided in the context, but you should verify the version and configuration as described in the resources.

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute arbitrary code with the privileges of the application server user. This could lead to full system compromise, data theft, or disruption of services. Exploitation requires specific non-default conditions, such as the WebAuthn flow being accessible and the attacker having previously written malicious data to a storage attribute.

Mitigation Strategies

Immediately upgrade OpenAM to version 16.1.1 or later to apply the security fix. Ensure the WebAuthn authentication module is properly configured and that user-writable attributes are restricted to prevent unauthorized data injection. Review and restrict access to attributes that could be exploited via the WebAuthn flow.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45051. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart