CVE-2026-62263: OpenAM WebAuthn Auth Bypass Vulnerability

CVE-2026-62263 Overview

Open Identity Platform OpenAM contains an insecure deserialization vulnerability [CWE-502] in the WebAuthn authentication module. The WebAuthnAuthentication.deserialize method applies an ObjectInputFilter that only validates the root object as AuthenticatorImpl, permitting any class at nested depths. A pre-authentication attacker can submit a crafted userHandle containing a serialized graph with a valid AuthenticatorImpl root and a nested gadget class. When a usable gadget is present on the classpath, readObject or readResolve executes before the cast and assertion checks run. This bypasses an earlier remediation for a prior WebAuthn deserialization flaw. The issue is fixed in version 16.1.2.

Critical Impact

Unauthenticated remote attackers can achieve arbitrary code execution on OpenAM servers by supplying a malicious userHandle payload that triggers gadget chain execution during WebAuthn authentication.

Affected Products

• Open Identity Platform OpenAM versions prior to 16.1.2
• OpenAM deployments exposing the WebAuthn authentication module
• Servers with vulnerable gadget classes present on the application classpath

Discovery Timeline

• 2026-09-15 - CVE-2026-62263 published to NVD
• 2026-09-15 - Last updated in NVD database
• 2026-09-15 - OpenAM 16.1.2 released with security fix

Technical Details for CVE-2026-62263

Vulnerability Analysis

The vulnerability resides in the WebAuthn authentication module inside openam-authentication/openam-auth-webauthn/src/main/java/org/openidentityplatform/openam/authentication/modules/webauthn/WebAuthnAuthentication.java. The deserialize method reconstructs an AuthenticatorImpl object from a client-supplied userHandle. To constrain deserialization, the code registered an ObjectInputFilter that checked only the root type against an allowlist containing AuthenticatorImpl.

The filter logic accepted any class encountered at object graph depth greater than 1. This meant nested fields, collection entries, and referenced objects were never validated. An attacker who crafts a serialized graph with AuthenticatorImpl as the outer object can embed arbitrary gadget classes as inner fields. Java deserialization invokes readObject and readResolve on nested objects before the outer cast completes, so gadgets execute before any assertion or type validation runs.

Root Cause

The underlying flaw is incomplete allowlist enforcement in the ObjectInputFilter implementation. The filter validated depth-1 objects only, leaving deeper graph nodes unchecked. This is a partial-fix regression: the earlier WebAuthn deserialization CVE was patched with a filter, but the patch did not enforce recursive validation across the full object graph.

Attack Vector

Exploitation requires no authentication. An attacker sends a WebAuthn authentication request containing a userHandle field whose value is a base64-encoded serialized Java object graph. The graph declares AuthenticatorImpl as the root and embeds a gadget chain such as those from Commons Collections, Spring, or other libraries commonly present on Java classpaths. When OpenAM deserializes the payload, gadget class methods execute in the server JVM, yielding remote code execution.

// Patch excerpt: WebAuthnAuthentication.java
private static final Set<String> ALLOWED_AUTHENTICATOR_CLASSES = Set.of(
        AuthenticatorImpl.class.getName()
);

// The whole AuthenticatorImpl object graph is made up of webauthn4j data
// objects, so the library's own package is allowlisted as a prefix.
private static final String WEBAUTHN4J_PACKAGE_PREFIX = "com.webauthn4j.";

// Safe JDK value/container types that legitimately appear in the graph.
private static final Set<String> ALLOWED_JDK_CLASSES = Set.of(
        "java.lang.Boolean",
        "java.lang.Byte",
        "java.lang.Character",
        "java.lang.Short",
        "java.lang.Integer",
        "java.lang.Long",
        "java.lang.Number",
        "java.lang.String",
        "java.lang.Enum",
        "java.math.BigInteger",
        "java.util.UUID",
        "java.util.ArrayList",
        "java.util.LinkedList",
        "java.util.HashSet"
);

Source: OpenAM Security Patch Commit

Detection Methods for CVE-2026-62263

Indicators of Compromise

• Unusual WebAuthn authentication requests containing oversized or base64-encoded userHandle values that decode to Java serialization magic bytes (AC ED 00 05).
• Java process spawning unexpected child processes such as sh, bash, cmd.exe, or powershell.exe from the OpenAM application server JVM.
• Outbound network connections from the OpenAM host to unfamiliar external endpoints following WebAuthn authentication traffic.

Detection Strategies

• Inspect HTTP request bodies to the WebAuthn authentication endpoint for userHandle parameters exceeding expected length or containing serialized Java object signatures.
• Monitor JVM stack traces and application logs for ClassCastException or InvalidClassException events originating in WebAuthnAuthentication.deserialize.
• Correlate authentication endpoint requests with subsequent process creation, file writes to /tmp, or reverse shell patterns on the OpenAM host.

Monitoring Recommendations

• Enable detailed WebAuthn module logging and forward events to a centralized SIEM for correlation with process telemetry.
• Deploy endpoint detection on OpenAM servers to observe child process creation and network egress from the Java process.
• Track failed and anomalous authentication attempts against WebAuthn endpoints from a single source IP within short time windows.

How to Mitigate CVE-2026-62263

Immediate Actions Required

• Upgrade OpenAM to version 16.1.2 immediately across all deployments.
• Restrict network access to the OpenAM WebAuthn authentication endpoint using firewall rules or a reverse proxy allowlist until patching is complete.
• Audit the OpenAM application classpath and remove or update libraries known to contain deserialization gadgets, such as vulnerable Commons Collections versions.

Patch Information

The fix is available in OpenAM Release 16.1.2. The patch expands the ObjectInputFilter to recursively validate every class in the deserialized object graph against an allowlist of AuthenticatorImpl, the com.webauthn4j. package prefix, and a fixed set of safe JDK value and container types. See the GitHub Security Advisory GHSA-gf8h-gq53-288j for full details.

Workarounds

• Disable the WebAuthn authentication module in OpenAM configuration if it is not required by production authentication flows.
• Place a Web Application Firewall in front of OpenAM with rules that block requests where userHandle decodes to Java serialization headers (AC ED 00 05).
• Run the OpenAM JVM with a system-wide jdk.serialFilter property to reject unknown classes at the JVM layer as a defense-in-depth control.

# Defense-in-depth: enforce a strict JVM-wide deserialization filter
export JAVA_OPTS="$JAVA_OPTS \
  -Djdk.serialFilter='com.webauthn4j.**;org.openidentityplatform.openam.authentication.modules.webauthn.AuthenticatorImpl;java.util.UUID;java.lang.*;java.util.ArrayList;java.util.HashSet;!*'"