CVE-2026-62263
Received Received - Intake

WebAuthn Deserialization Flaw in OpenAM

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, WebAuthnAuthentication.deserialize applies an ObjectInputFilter that allows every serialized object at depth greater than 1 and therefore constrains only an AuthenticatorImpl root object. A pre-authentication attacker can supply a userHandle whose serialized graph has a valid AuthenticatorImpl root and a nested gadget class, causing readObject or readResolve execution before the cast and assertion verification when a usable gadget is on the classpath. This bypasses the incomplete remediation for the earlier WebAuthn deserialization vulnerability. This issue is fixed in version 16.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-62263
EUVD
EUVD-2026-78362

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
forgerock openam 16.1.2
openidentityplatform openam to 16.1.2 (exc)
openidentityplatform openam to 16.1.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-62263 is a high-severity Java deserialization vulnerability in OpenAM's WebAuthn authentication module affecting versions up to 16.1.1. The issue involves improper ObjectInputFilter configuration that fails to restrict nested objects during deserialization. An attacker can craft a malicious serialized stream with a valid AuthenticatorImpl root and a nested gadget class. During deserialization, the gadget's methods execute before validation, enabling remote code execution if a gadget is on the classpath. The flaw bypasses earlier remediation attempts for similar vulnerabilities.

Detection Guidance

To detect this vulnerability, check if your OpenAM version is below 16.1.2. Use commands like 'curl -s https://your-openam-server/openam/version' or inspect the server logs for WebAuthn-related errors. Monitor for unusual deserialization activity or unexpected RCE attempts.

Impact Analysis

This vulnerability allows pre-authentication remote attackers to execute arbitrary code on the server hosting OpenAM. An attacker could gain full control over the system, steal sensitive data, install malware, or disrupt services. The attack requires no authentication and is triggered via a user-controlled parameter, making it highly dangerous for unpatched systems.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and system integrity under GDPR and HIPAA. GDPR mandates appropriate technical measures to ensure data security, while HIPAA requires safeguards against unauthorized access. A successful RCE exploit could lead to unauthorized data access, breaching confidentiality and integrity requirements, potentially resulting in regulatory penalties and legal consequences.

Mitigation Strategies

Upgrade OpenAM to version 16.1.2 or later immediately. If upgrading is not possible, disable WebAuthn authentication temporarily or apply network-level mitigations like WAF rules to block malicious serialized payloads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62263. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart