EUVD-2026-78362
GHSA-gf8h-gq53-288j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network pre-auth vector (AV:N/PR:N/UI:N) but AC:H because successful RCE depends on a compatible deserialization gadget being present on the classpath; full C/I/A impact.
Primary rating from Vendor (https://github.com/OpenIdentityPlatform/OpenAM).
CVSS VectorVendor: https://github.com/OpenIdentityPlatform/OpenAM
Lifecycle Timeline
6DescriptionCVE.org
Summary
The GHSA-6c99-87fr-6q7r fix wrapped WebAuthn authenticator deserialization in an ObjectInputFilter meant to allow only AuthenticatorImpl, but it short-circuits to ALLOWED for any object at stream depth > 1. Because the Java serialization filter is consulted for every class in the graph (and depth == 1 only for the root's concrete class), the allowlist constrains only the root and leaves the entire nested graph unchecked.
Impact
An attacker can craft a stream rooted at AuthenticatorImpl with an arbitrary gadget chain nested inside. The gadget's readObject/readResolve executes during readObject() - before the cast and before any assertion verification - enabling remote code execution when a gadget is on the classpath. The deserialization sink is reached pre-authentication via an attacker-chosen userHandle.
AnalysisAI
Pre-authentication remote code execution in Open Identity Platform OpenAM (openam-auth-webauthn) before 16.1.2 arises from an incomplete fix to the earlier deserialization flaw GHSA-6c99-87fr-6q7r: the ObjectInputFilter guarding WebAuthn authenticator deserialization short-circuits to ALLOWED for any object at stream depth greater than 1, so only the root class is constrained while the entire nested object graph is unchecked. An attacker who reaches the WebAuthn login path with a chosen userHandle can supply a stream rooted at AuthenticatorImpl with a gadget chain nested inside, achieving RCE when a suitable gadget is on the classpath. No active exploitation is listed in CISA KEV and no standalone public exploit is identified, though the vendor's fix commit ships a test demonstrating nested-gadget execution; EPSS is 0.89% (57th percentile).
Technical ContextAI
OpenAM is a Java-based access-management/SSO server; the affected component is the WebAuthn authentication module (Maven package org.openidentityplatform.openam:openam-auth-webauthn). The root cause is CWE-502 (deserialization of untrusted data). Java's serialization filter (ObjectInputFilter) is invoked for every class encountered while reconstructing an object graph, and filterInfo.depth() equals 1 only for the root's concrete class - nested fields, superclasses, and collection elements are reported at depth > 1. The vulnerable code returned Status.ALLOWED whenever depth() > 1, so the allowlist that was intended to permit only AuthenticatorImpl effectively validated nothing beyond the root. During ObjectInputStream.readObject(), any nested object's readObject()/readResolve() executes before the cast to Authenticator and before any WebAuthn assertion verification, making the deserialization a reachable RCE sink. The fixed code (commit 9dd0fbe) validates each resolved class: rejecting a non-AuthenticatorImpl root at depth 1, unwrapping array component types, and allowlisting only the webauthn4j package prefix plus a fixed set of safe JDK value/container types.
RemediationAI
Vendor-released patch: upgrade to OpenAM 16.1.2, which replaces the depth>1 short-circuit with per-class validation (rejecting a non-AuthenticatorImpl root and allowlisting only the com.webauthn4j.* package prefix and a fixed set of safe JDK value/container types) - see commit https://github.com/OpenIdentityPlatform/OpenAM/commit/9dd0fbe07f70f118cf45042d3a9ffb32f3c21e08 and advisory https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-gf8h-gq53-288j. If immediate patching is impossible, disable the WebAuthn authentication module/chains so the vulnerable deserialization path is never invoked (trade-off: WebAuthn-based logins stop working); restrict network access to the OpenAM authentication endpoints to trusted networks/reverse-proxy allowlists to remove pre-auth reachability; and audit/prune the deployment classpath to remove known deserialization gadget libraries, which raises the bar for exploitation but is not a reliable standalone fix. Upgrading remains the only complete remediation.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today