CVE-2026-62263

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-62263
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62263.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-62263
Aliases
Downstream
Published
2026-09-15T09:52:58Z
Modified
2026-09-17T08:15:56Z
Severity
  • 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass
Details

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, WebAuthnAuthentication.deserialize applies an ObjectInputFilter that allows every serialized object at depth greater than 1 and therefore constrains only an AuthenticatorImpl root object. A pre-authentication attacker can supply a userHandle whose serialized graph has a valid AuthenticatorImpl root and a nested gadget class, causing readObject or readResolve execution before the cast and assertion verification when a usable gadget is on the classpath. This bypasses the incomplete remediation for the earlier WebAuthn deserialization vulnerability. This issue is fixed in version 16.1.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-502"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62263.json"
}
References

Affected packages

Git / github.com/openidentityplatform/openam

Affected ranges

Type
GIT
Repo
https://github.com/openidentityplatform/openam
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9dd0fbe07f70f118cf45042d3a9ffb32f3c21e08
Fixed
73a64a20348d5448e0820469539c8af75f08d314
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "16.1.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

13.*
13.0.0
13.0.0-RC1
13.0.0-RC10
13.0.0-RC2
13.0.0-RC3
13.0.0-RC4
13.0.0-RC5
13.0.0-RC6
13.0.0-RC7
13.0.0-RC8
13.0.0-RC9
14.*
14.0.0
14.0.1
14.0.2
14.0.3
14.0.4
14.0.5
14.0.6
14.1.1
14.1.10
14.1.11
14.1.12
14.1.13
14.1.16
14.1.17
14.1.2
14.1.3
14.1.4
14.1.5
14.1.6
14.1.7
14.1.8
14.1.9
14.2.1
14.2.2
14.3.1
14.4.1
14.4.2
14.5.1
14.5.2
14.5.3
14.5.4
14.6.2
14.6.3
14.6.4
14.6.5
14.6.6
14.7.0
14.7.1
14.7.2
14.7.3
14.7.4
14.8.1
14.8.2
14.8.3
14.8.4
15.*
15.0.0
15.0.1
15.0.2
15.0.3
15.0.4
15.1.0
15.1.1
15.1.2
15.1.3
15.1.4
15.1.5
15.1.6
15.2.0
15.2.1
15.2.2
16.*
16.0.3
16.0.4
16.0.5
16.0.6
16.1.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62263.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "300892709995752600297300882855720813025",
                "134489059539257899292017569511051217255",
                "14984273271998650707426652724379454032",
                "330508998647977613261543659064988338509",
                "132344394188562217024451992560456583994",
                "166351777029273874683844504259828161478",
                "320542433970164632144013878259938806022",
                "279651339661801232927078845734205809229",
                "137307033923304792036408496962702711726",
                "319161297130484222891513514816903320311",
                "173669204121573916947386127985344630030"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-62263-3be4384a",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openidentityplatform/openam/commit/9dd0fbe07f70f118cf45042d3a9ffb32f3c21e08",
        "target": {
            "file": "openam-authentication/openam-auth-webauthn/src/main/java/org/openidentityplatform/openam/authentication/modules/webauthn/WebAuthnAuthentication.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "162896521443428963922294223997745335743",
                "83664901016198083371520281040543341894",
                "314358266118408012889934797175996532260"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-62263-8f510544",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openidentityplatform/openam/commit/9dd0fbe07f70f118cf45042d3a9ffb32f3c21e08",
        "target": {
            "file": "openam-authentication/openam-auth-webauthn/src/test/java/org/openidentityplatform/openam/authentication/modules/webauthn/WebAuthnAuthenticationRceTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "301960258716445583424348533938700954946",
            "length": 736
        },
        "id": "CVE-2026-62263-ae492609",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openidentityplatform/openam/commit/9dd0fbe07f70f118cf45042d3a9ffb32f3c21e08",
        "target": {
            "file": "openam-authentication/openam-auth-webauthn/src/main/java/org/openidentityplatform/openam/authentication/modules/webauthn/WebAuthnAuthentication.java",
            "function": "deserialize"
        }
    }
]
vanir_signatures_modified 
"2026-09-17T08:15:56Z"