CVE-2026-62263

OpenAM (Open Access Management) versions before 16.1.2 contain a Java deserialization flaw (CWE-502) in WebAuthnAuthentication.deserialize, where the ObjectInputFilter only constrains the root AuthenticatorImpl object and permits arbitrary serialized objects at nesting depth greater than one. An unauthenticated attacker can submit a WebAuthn userHandle whose serialized object graph carries a valid AuthenticatorImpl root wrapping a nested gadget class, causing readObject or readResolve to execute before the type cast and assertion verification. If a usable gadget class is present on the server classpath, this yields remote code execution with the privileges of the application server, bypassing an incomplete fix for an earlier WebAuthn deserialization vulnerability. Affected deployments are self-hosted OpenAM instances prior to 16.1.2 where the WebAuthn authentication flow is reachable over the network. No public proof of concept is known, the issue is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported; the flaw is fixed in version 16.1.2.

What to do: Upgrade to OpenAM 16.1.2 or later as the primary fix. Until patched, disable or restrict the WebAuthn authentication module and limit network access to authentication endpoints, and review logs for anomalous oversized or malformed userHandle values in WebAuthn registration/authentication requests. As defense in depth, minimize gadget-bearing libraries (e.g., known deserialization gadget chains) on the OpenAM server classpath.