OpenAM WebAuthn Filter Bypass Enables Pre-Auth Java Deserialization RCE (CVE-2026-62263)

A GitHub Security Advisory (GHSA-gf8h-gq53-288j) reports that a prior fix for OpenAM's WebAuthn authenticator deserialization (GHSA-6c99-87fr-6q7r) is incomplete. The earlier patch wrapped deserialization in a Java ObjectInputFilter intended to restrict input to AuthenticatorImpl objects, but according to the advisory, the filter logic short-circuits to ALLOWED for any object encountered at stream depth greater than 1. Since Java's deserialization filter is invoked per-class across the entire object graph, and the allowlist check only applies at depth 1 (the root object), everything nested beneath the root goes unchecked.

This affects org.openidentityplatform.openam:openam-auth-webauthn and is tracked as CVE-2026-62263, with a public proof-of-concept reportedly available. No CVSS score has been published at this time.

Why It Matters

Per the advisory, an attacker can craft a serialized stream rooted at the allowed AuthenticatorImpl class but containing an arbitrary attacker-chosen gadget chain nested within it. Because gadget readObject/readResolve methods can execute during deserialization — before the object is cast or any assertion is verified — this can lead to remote code execution, provided a suitable gadget is present on the application's classpath. Notably, the advisory indicates the deserialization sink is reachable pre-authentication via an attacker-controlled userHandle value, meaning exploitation does not require valid credentials. This makes the flaw significant for any organization running affected OpenAM WebAuthn authentication components, particularly those exposing WebAuthn endpoints to untrusted networks.

What Defenders Should Do Now

• Identify whether your environment uses org.openidentityplatform.openam:openam-auth-webauthn and confirm whether the prior GHSA-6c99-87fr-6q7r patch was applied — that patch alone is not sufficient per this new advisory.
• Watch vendor channels for an updated patch addressing the depth>1 filter bypass specifically, since the original allowlist approach needs to be corrected rather than reapplied.
• As a hunting angle, monitor WebAuthn authentication endpoints for anomalous or malformed serialized payloads, unexpected classes appearing in deserialization-related exceptions or logs, and unusual process/child-process activity originating from the OpenAM service around authentication attempts.
• Where feasible, consider restricting exposure of WebAuthn authentication endpoints to trusted networks until a verified fix is confirmed, and review classpath dependencies for known deserialization gadget chains that could be leveraged if this bypass is exploited.

This is developing intel based on a same-day GitHub Security Advisory; details such as affected version ranges and a confirmed fix were not fully specified at publication time. For the authoritative technical writeup, see the original advisory: GHSA-gf8h-gq53-288j.