CVE-2026-45794: OpenAM Push Notification RCE Vulnerability

CVE-2026-45794 Overview

CVE-2026-45794 is an unsafe Java deserialization vulnerability in Open Identity Platform OpenAM prior to version 16.1.1. The flaw resides in the anonymous Push Notification SNS callback handled by SnsMessageResource. After a messageId expires from the in-memory dispatcher, the handler falls back to a Core Token Service (CTS) predicate blob, treats top-level blob keys as Java class names for Class.forName, and deserializes attacker-controlled JSON through Jackson. A low-privileged user who initiates Push Registration can replace the persistent blob through anonymous callbacks and trigger class loading in the OpenAM Java Virtual Machine (JVM). The vulnerability is tracked under [CWE-502: Deserialization of Untrusted Data].

Critical Impact
The deserialization primitive can cause classpath-dependent process execution, arbitrary file writes, or denial of service against the OpenAM identity provider.

Affected Products

Open Identity Platform OpenAM versions prior to 16.1.1
OpenAM deployments exposing the Push Notification SNS callback endpoint
OpenAM instances with Push Registration authentication configured

Discovery Timeline

2026-09-15 - CVE-2026-45794 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-45794

Vulnerability Analysis

The vulnerability lives in openam-push-notification/src/main/java/org/forgerock/openam/services/push/sns/SnsMessageResource.java. When a Push Registration flow starts, OpenAM tracks messageId values in an in-memory dispatcher. After that state expires, the SNS callback handler falls back to a persisted CTS predicate blob to resume processing.

The fallback path parses the blob as JSON and interprets each top-level key as a Java class name. It then invokes Class.forName on those keys and constructs instances by feeding attacker-controlled JSON to Jackson. This yields an unsafe deserialization primitive reachable through anonymous HTTP callbacks. Exploitation depends on classes present in the OpenAM classpath, which determines whether the outcome is process execution, arbitrary file writes, or denial of service. Command execution was not confirmed on the tested stock classpath.

Root Cause

The root cause is trust placed in persistent CTS blob content that originated from anonymous callback input. Using top-level JSON keys as fully qualified class names for reflective loading, combined with Jackson polymorphic deserialization of attacker-controlled data, violates safe deserialization practice.

Attack Vector

A low-privileged authenticated user begins Push Registration and captures the messageId, shared secret, and challenge. The attacker waits for the in-memory dispatcher entry to expire. The attacker then sends crafted anonymous callbacks to SnsMessageResource that overwrite the persistent blob with attacker-supplied JSON. Subsequent callback handling triggers class loading and Jackson-driven object construction inside the OpenAM JVM.

java

// Patch context from SnsMessageResource.java
 * information: "Portions copyright [year] [name of copyright owner]".
 *
 * Copyright 2016 ForgeRock AS.
-* Portions copyright 2025 3A Systems LLC.
+* Portions copyright 2025-2026 3A Systems LLC.
 */

package org.forgerock.openam.services.push.sns;

Source: OpenAM Security Patch Commit ca15cba

Detection Methods for CVE-2026-45794

Indicators of Compromise

Anonymous POST requests to Push Notification SNS callback endpoints handled by SnsMessageResource containing unexpected fully qualified Java class names as JSON keys.
CTS token entries for Push predicate blobs modified after the associated messageId dispatcher entry has expired.
OpenAM JVM log entries referencing Class.forName failures, Jackson deserialization exceptions, or ClassNotFoundException originating from the push notification package.

Detection Strategies

Inspect access logs for repeated anonymous callback requests targeting SNS message endpoints paired with unusually large or structurally atypical JSON payloads.
Correlate Push Registration initiation by low-privileged accounts with subsequent anonymous callbacks reusing the same messageId after in-memory expiry.
Monitor OpenAM process activity for unexpected child processes, file writes, or outbound connections originating from the OpenAM JVM.

Monitoring Recommendations

Forward OpenAM container and JVM logs to a centralized analytics platform and alert on deserialization exceptions from push notification classes.
Baseline normal Push Registration callback volumes and alert on deviations, particularly anonymous callback bursts.
Track CTS store writes to Push predicate records and flag modifications not tied to legitimate registration flows.

How to Mitigate CVE-2026-45794

Immediate Actions Required

Upgrade OpenAM to version 16.1.1, which removes the unsafe fallback and closes the deserialization primitive.
Restrict network exposure of the SNS callback endpoint to trusted Push Notification service origins where feasible.
Review authentication chains and disable Push Registration modules on instances that do not require them until patching completes.

Patch Information

The fix is available in OpenAM Release 16.1.1. The corrective changes are captured in Commit ca15cba and documented in GHSA-pp89-732f-3g8q.

Workarounds

Place a reverse proxy or web application firewall (WAF) in front of OpenAM to block anonymous requests to the Push Notification SNS callback path.
Reduce or eliminate the fallback window by ensuring Push Registration flows complete promptly and by monitoring for stale messageId reuse.
Rotate any shared secrets and challenges tied to Push Registration sessions initiated by untrusted or low-privileged accounts.

bash

# Example WAF rule to block anonymous JSON with class-name keys targeting the SNS callback
# Reject requests to the push SNS endpoint containing suspicious Java package keys
SecRule REQUEST_URI "@contains /json/push/sns/message" \
    "phase:2,deny,status:403,id:2026045794,\
     chain,msg:'Block potential CVE-2026-45794 deserialization payload'"
    SecRule REQUEST_BODY "@rx \"(java\\.|javax\\.|org\\.|com\\.sun\\.)[A-Za-z0-9_.$]+\"\\s*:" \
        "t:none"