EUVD-2026-78358
GHSA-pp89-732f-3g8q
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but requires a low-privileged registration user (PR:L) and a dispatcher-expiry timing window (AC:H); strong integrity/availability impact via blob overwrite and DoS, limited confidentiality, RCE unconfirmed.
Primary rating from Vendor (https://github.com/OpenIdentityPlatform/OpenAM).
CVSS VectorVendor: https://github.com/OpenIdentityPlatform/OpenAM
Lifecycle Timeline
5Blast Radius
ecosystem impact- 1 maven packages depend on org.openidentityplatform.openam:openam-push-notification (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 16.1.1.
DescriptionCVE.org
Summary
Description
A Deserialization of Untrusted Data (CWE-502) issue exists in OpenAM's Push Notification SNS callback resource. The REST route that handles SNS push messages is mounted with anonymous access and, when a supplied message identifier has expired from the in-memory dispatcher, falls back to a CTS-stored predicate blob whose top-level keys are treated as Java class names and passed to Class.forName(...) before attacker-controlled JSON is deserialized via Jackson. This impacts OpenAM Community Edition through version 16.0.6. This issue was patched in version 16.1.1.
Arbitrary attacker-controlled code execution was not confirmed on tested stock classpaths for the latest release, but the flaw yields a reliable class-loading and Jackson-construction primitive whose impacts include remotely triggerable process execution, file writes, and DoS, depending on the deployment's classpath and environment.
Impact
OpenAM Community Edition deployments through version 16.0.6 that enable the Push Notification Service with SNS callbacks are potentially affected. While the callback route itself is anonymous, the planting step requires a low-privileged user who can start Push Registration and read their own QR-code payload. After that user obtains the server-issued messageId, shared secret, and challenge, they can wait for the in-memory dispatcher entry to expire and then send anonymous SNS callbacks that overwrite the persistent CTS blob with attacker-controlled JSON. A later anonymous callback for the same messageId causes OpenAM to load an attacker-named class and construct it with attacker-controlled values.
The planted blob is processed server-side with internal CTS privileges, giving a reliable class-loading and Jackson-construction primitive that can corrupt the push-token record and trigger classpath-dependent side effects in the OpenAM JVM. Arbitrary attacker-controlled command execution was not confirmed on the tested stock classpaths; practical severity depends on enabled Push Registration flows, JDK version, bundled or co-deployed classes, and whether any reachable class-loading or construction side effects are security-relevant in the deployment.
Patch
This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.
AnalysisAI
Unsafe Java deserialization in OpenAM Community Edition's Push Notification SNS callback route (through version 16.0.6) allows a low-privileged user who can start Push Registration to plant an attacker-controlled predicate blob in the CTS store, which OpenAM later loads by attacker-supplied class name and deserializes with Jackson when an anonymous SNS callback references the same messageId. The result is a reliable server-side class-loading and arbitrary-object-construction primitive that can corrupt push-token records and trigger classpath-dependent side effects such as process execution, file writes, or denial of service; the vendor explicitly states that arbitrary attacker-controlled code execution was not confirmed on stock classpaths, so real-world severity hinges on what classes are reachable in the deployment. The flaw is patched in 16.1.1 (commit ca15cba, GHSA-pp89-732f-3g8q); there is no CISA KEV listing and no public exploit code identified at time of analysis.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today