CVE-2026-45051: OpenAM WebAuthn RCE Vulnerability

CVE-2026-45051 Overview

Open Access Management (OpenAM) contains an insecure deserialization vulnerability in the WebAuthn authentication module. Versions prior to 16.1.1 load a serialized AuthenticatorImpl object graph from a configured userAttribute through loadAuthenticators without applying an ObjectInputFilter. When an attacker has previously written controlled data to that attribute through delegated administration, provisioning, directory access, legacy REST self-registration, or unsafe configuration, the WebAuthn flow deserializes that data before assertion verification. This enables execution of a classpath gadget in the application server process. The issue is fixed in version 16.1.1.

Critical Impact
Conditional unauthenticated remote code execution in the OpenAM application server process through Java deserialization of attacker-controlled attribute data [CWE-502].

Affected Products

Open Identity Platform OpenAM versions prior to 16.1.1
OpenAM openam-auth-webauthn authentication module
Deployments where the WebAuthn flow is reachable and the configured userAttribute is writable through delegated administration, provisioning, directory access, or legacy REST self-registration

Discovery Timeline

2026-09-15 - CVE-2026-45051 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-45051

Vulnerability Analysis

The vulnerability resides in WebAuthnAuthentication within the openam-auth-webauthn module. The loadAuthenticators method reads a serialized AuthenticatorImpl object graph directly from the configured userAttribute. The deserialization occurs before WebAuthn assertion verification, so no cryptographic check gates the untrusted input. Because no ObjectInputFilter is applied, any class present on the OpenAM classpath can be reached during object reconstruction. If a gadget chain exists in the deployed dependencies, an attacker triggers arbitrary code execution in the Java application server process hosting OpenAM.

Root Cause

The root cause is insecure Java deserialization [CWE-502] of user-controlled attribute values without a class allowlist. The WebAuthn module trusts the persisted authenticator blob as a well-formed serialized object. It performs no type filtering, no signature verification, and no schema validation prior to invoking ObjectInputStream.readObject.

Attack Vector

Exploitation requires two preconditions. First, the WebAuthn authentication flow must be reachable by the attacker. Second, the attacker must have previously written a malicious serialized payload to the target user's WebAuthn userAttribute. Write access can originate from delegated administration privileges, provisioning workflows, direct directory (LDAP) writes, legacy REST self-registration endpoints, or misconfigured attribute permissions. Once the payload is stored, initiating the WebAuthn flow for that account triggers deserialization and gadget execution.

java

// Patch reference from openam-auth-webauthn (WebAuthnAuthentication.java)
// Copyright 2019-2025 3A-Systems LLC. All rights reserved.
// Updated to: Copyright 2019-2026 3A-Systems LLC. All rights reserved.
// The fix restricts deserialization of the AuthenticatorImpl object graph
// loaded from the configured userAttribute in loadAuthenticators.

Source: OpenIdentityPlatform OpenAM commit 8b02328

Detection Methods for CVE-2026-45051

Indicators of Compromise

Unexpected binary or Base64-encoded serialized Java content stored in the WebAuthn userAttribute of directory entries
Java process spawning shell interpreters, curl, wget, or scripting engines from the OpenAM application server (Tomcat, Jetty, WildFly)
Outbound network connections from the OpenAM JVM to unrecognized hosts immediately following a WebAuthn authentication attempt
Stack traces in OpenAM logs referencing ObjectInputStream.readObject, loadAuthenticators, or AuthenticatorImpl deserialization failures

Detection Strategies

Inspect directory entries for the configured WebAuthn userAttribute and flag values that do not conform to the expected AuthenticatorImpl serialized structure
Monitor OpenAM authentication logs for WebAuthn flow invocations correlated with anomalous process creation on the host
Deploy Java Runtime Application Self-Protection (RASP) or Java agent instrumentation to alert on deserialization of non-allowlisted classes

Monitoring Recommendations

Enable audit logging on delegated administration, provisioning, and self-registration endpoints that can modify WebAuthn attributes
Track directory write operations to WebAuthn userAttribute fields and alert on writes originating from non-administrative sources
Correlate WebAuthn authentication requests with child process creation and outbound connections from the OpenAM JVM

How to Mitigate CVE-2026-45051

Immediate Actions Required

Upgrade OpenAM to version 16.1.1, which applies an ObjectInputFilter to the WebAuthn deserialization path
Audit directory entries for unexpected content in the WebAuthn userAttribute and remove suspicious serialized payloads
Restrict write access to WebAuthn attributes so only trusted registration flows can populate them
Disable legacy REST self-registration endpoints if not required

Patch Information

The fix is available in OpenAM 16.1.1. The patch modifies the openam-auth-webauthn module to constrain deserialization of the AuthenticatorImpl object graph loaded through loadAuthenticators. Refer to the OpenAM 16.1.1 release notes, the GitHub Security Advisory GHSA-6c99-87fr-6q7r, and the remediation commit 8b02328.

Workarounds

Disable the WebAuthn authentication module until the upgrade to 16.1.1 is completed
Enforce strict Access Control Instructions (ACIs) on the directory to prevent unauthorized writes to the WebAuthn userAttribute
Remove or restrict delegated administration privileges that grant modification of user WebAuthn attributes
Apply a JVM-wide ObjectInputFilter via -Djdk.serialFilter to deny known deserialization gadget classes

bash

# Example JVM-wide deserialization allowlist for the OpenAM application server
JAVA_OPTS="$JAVA_OPTS -Djdk.serialFilter='!org.apache.commons.collections.functors.*;!org.apache.commons.collections4.functors.*;!com.sun.rowset.JdbcRowSetImpl;!javax.management.BadAttributeValueExpException;maxdepth=20;maxrefs=1000'"
export JAVA_OPTS