Which versions of OpenAM's WebAuthn are affected by CVE-2026-45051?

A critical remote code execution vulnerability (CVE-2026-45051) in Open Identity Platform OpenAM Community Edition through version 16.0.6 enables pre-authentication arbitrary code execution via Java…. A patch is available.

How to fix or mitigate CVE-2026-45051?

Within 24 hours: Inventory all OpenAM Community Edition deployments running versions through 16.0.6 and assess WebAuthn module usage and storage attribute accessibility controls. Within 7 days: Upgrade all affected instances to version 16.1.1 and validate that WebAuthn userAttribute storage is properly restricted from untrusted input sources. Within 30 days: Complete organization-wide rollout and execute functional testing of WebAuthn to confirm the vulnerability is remediated across all environments.

OpenAM's WebAuthn CVE-2026-45051

Q: What is the CVSS score of CVE-2026-45051?

CVE-2026-45051 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-78363 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-24 https://github.com/OpenIdentityPlatform/OpenAM

GHSA-6c99-87fr-6q7r

RCE Deserialization

9.2

CVSS 4.0 · Vendor: https://github.com/OpenIdentityPlatform/OpenAM

Severity by source

Vendor (https://github.com/OpenIdentityPlatform/OpenAM) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

WebAuthn flow is network-reachable (AV:N) but exploitation needs a non-default config plus a prior write primitive into a controlled attribute, so AC:H and PR:L; deserialization yields full code execution (C/I/A:H).

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/OpenIdentityPlatform/OpenAM).

CVSS VectorVendor: https://github.com/OpenIdentityPlatform/OpenAM

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Sep 15, 2026 - 10:32 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 15, 2026 - 10:22 vuln.today

cvss_changed

CVSS changed

Sep 15, 2026 - 10:22 NVD

9.2 (CRITICAL)

Source Code Evidence Fetched

Jun 24, 2026 - 17:50 vuln.today

Analysis Generated

Jun 24, 2026 - 17:50 vuln.today

DescriptionCVE.org

Summary

Description

A deserialization of untrusted data vulnerability (CWE-502) exists in OpenAM's WebAuthn authentication module. Under certain conditions, this may allow an attacker to achieve arbitrary code execution in the context of the application server. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1.

This is not the default configuration. Exploitation requires that an attacker has previously been able to write attacker-controlled data to a storage attribute read by the WebAuthn module, and that the WebAuthn authentication flow is reachable.

Impact

WebAuthn is a modern shipped module, but the vulnerable configuration requires either the default storage attribute to become attacker-writable, or the WebAuthn userAttribute to be set to an attacker-writable string attribute. That is not the default, but it is feasible in deployments because the product exposes the storage attribute as a free-form admin setting and does not warn or enforce that it must be server-managed and non-user-writable. This may exist through delegated administration, provisioning, write access to the backing LDAP/directory user record, legacy REST self-registration, or unsafe reconfiguration of userAttribute.

In any deployment where the attribute becomes user writable, an attacker can execute arbitrary code as the application server user.

Patch

This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.

AnalysisAI

We need produce JSON only. Need analyze CVE thoroughly. Need obey all fields strings, array only data_quality_flags empty likely. Need set product_name. Let's parse input.

CVE-2026-45051: OpenAM Community Edition WebAuthn authentication module deserialization vulnerability. Product: OpenAM Community Edition? primary product name: OpenAM. Maybe "OpenAM Community Edition" 3 words? Product_name 1-3 words ONLY. "OpenAM" is fine. Specific product. Use "OpenAM".

Summary: need original synthesis. Do not copy description. Include deserialization CWE-502, affected through 16.0.6 patched 16.1.1, requires attacker-controlled data in storage attribute read by WebAuthn module and WebAuthn flow reachable. Active exploitation? KEV? Input doesn't list KEV; patch available. POC? Input no explicit POC; source code evidence includes test RCE, but not public exploit. Probably no public exploit identified. EPSS? Not provided in input. Could mention no EPSS data. Actually instructions: mention EPSS if notable. Since no EPSS provided, say EPSS not provided? Summary can mention no known active exploitation, no public exploit identified? Use exact phrase. Risk if notable: CVSS 9.2 high but due prerequisites. Need synthesize.

technical_context: underlying Java deserialization via ObjectInputStream, Apache Commons Lang SerializationUtils replaced with allowlisted ObjectInputFilter. CPE maven org.openidentityplatform.openam:openam-auth-webauthn <=16.0.6. CWE-502. WebAuthn module reads serialized authenticator from user identity storage attribute as Set<String>, base64? likely marshalled authenticators, deserializes. Root cause: untrusted data from identity attributes, no class restriction, gadget chain possible. Patched with allowlist only AuthenticatorImpl class.

risk_assessment: Compare CVSS 4.0 vector: AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N... Base score 9.2? Let's check CVSS 4.0 vector has AT:P (attack requirements present) and AC:L, PR:N, no UI. It yields severe. But description