CVE-2026-45794

OpenAM (Open Access Management) versions prior to 16.1.1 contain an unsafe deserialization flaw (CWE-502) in the anonymous Push Notification SNS callback handled by SnsMessageResource. After a messageId expires from the in-memory dispatcher, the code falls back to a persistent CTS predicate blob whose top-level JSON keys are passed to Class.forName and whose contents are deserialized via Jackson, allowing blob replacement through anonymous callbacks. A low-privileged user who initiates Push Registration and obtains the messageId, shared secret, and challenge can wait for expiry, overwrite the blob, and trigger attacker-influenced class loading and construction inside the OpenAM JVM, enabling classpath-dependent process execution, file writes, or denial of service (command execution was not confirmed on the tested stock classpath). All deployments running OpenAM before 16.1.1 that expose the push notification SNS callback are affected. No public proof of concept exists and the issue is not in the CISA KEV catalog, so exploitation in the wild is not known.

What to do: Upgrade OpenAM to version 16.1.1 or later. Until patched, restrict or disable anonymous access to the SNS push notification callback (SnsMessageResource), and consider blocking or rate-limiting SNS callbacks referencing expired or unknown messageIds. Review logs for anomalous Push Registration activity, repeated anonymous callbacks targeting the same messageId after expiry, and any unexpected class loading, file writes, or JVM crashes on OpenAM hosts.