CVE-2026-45051

Open Access Management (OpenAM) versions before 16.1.1 contain an untrusted deserialization flaw (CWE-502) in the WebAuthn authentication module: WebAuthnAuthentication loads a serialized AuthenticatorImpl object graph from a configured user attribute via loadAuthenticators without applying an ObjectInputFilter. Deserialization happens before WebAuthn assertion verification, so an attacker who can place controlled data in that attribute can execute a classpath gadget chain and achieve remote code execution inside the application server process. Exploitation is conditional — the WebAuthn flow must be enabled and reachable, and the attacker must already be able to write to the target attribute through delegated administration, provisioning, direct directory access, legacy REST self-registration, or unsafe configuration, none of which are default conditions. Despite the 9.2 CVSS 4.0 score, the practical attack surface is limited to OpenAM deployments running WebAuthn with permissive write paths to that attribute. The issue is fixed in version 16.1.1; there is no public PoC and no known exploitation in the wild.

What to do: Upgrade OpenAM to version 16.1.1 as the primary fix. If upgrading is delayed, disable or restrict the WebAuthn authentication module where it is not needed, and lock down all write paths to the WebAuthn user attribute (delegated administration rights, provisioning connectors, directory ACLs, and legacy REST self-registration). As defense in depth, apply JVM/app-server-level deserialization filtering and classpath hygiene, and audit directory logs for unexpected writes to that attribute.