Java deserialization RCE via ObjectInputFilter bypass in OpenAM WebAuthn (CVE-2026-62263)

A prior fix for WebAuthn authenticator deserialization in OpenAM wrapped the process in an `ObjectInputFilter` allowlisting only `AuthenticatorImpl`, but the filter short-circuits to `ALLOWED` for any object at stream depth greater than 1, leaving the entire nested object graph unchecked. An attacker can craft a serialized stream rooted at `AuthenticatorImpl` containing an arbitrary gadget chain; the gadget's `readObject`/`readResolve` executes before any cast or assertion verification, enabling remote code execution if a suitable gadget is on the classpath. The vulnerable deserialization sink is reachable pre-authentication via an attacker-controlled `userHandle`. Affected versions: - <= 16.1.1 We recommend updating to: 16.1.2. CVSS ? · our assessment: act_now Reference: https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-gf8h-gq53-288j Details: https://vuln.today/cve/CVE-2026-62263