Live › vulnerability › CVE-2026-45051
Go to dashboardOpenAM's WebAuthn authentication module deserializes data read from a storage attribute without checking it, which is a Java deserialization flaw (CWE-502). If an attacker can write to that attribute and reach the WebAuthn login flow, they can run code as the application server user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 15:29 UTC, 0h before NVD. All times on this page are UTC.
Deployments of OpenAM Community Edition 16.0.6 or earlier that use the WebAuthn module and where the storage attribute can be written by an attacker, through delegated admin, provisioning, directory write access, legacy self-registration, or an unsafe setting. The vulnerable configuration is not the default, but the product does not enforce that the attribute be server-managed. Teams not running OpenAM or not using WebAuthn can skip it.
userAttribute| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.openidentityplatform.openam:openam-auth-webauthn | maven | <= 16.0.6 | 16.1.1 |
openam-auth-webauthn version in the Maven build or deployed WEB-INF/lib; affected versions are 16.0.6 and below.userAttribute setting and the storage attribute it reads; flag any that users, delegated admins, provisioning, or directory write access can modify.openam-auth-webauthn to 16.1.1.userAttribute setting.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Description
A deserialization of untrusted data vulnerability (CWE-502) exists in OpenAM's WebAuthn authentication module. Under certain conditions, this may allow an attacker to achieve arbitrary code execution in the context of the application server. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1.
This is not the default configuration. Exploitation requires that an attacker has previously been able to write attacker-controlled data to a storage attribute read by the WebAuthn module, and that the WebAuthn authentication flow is reachable.
WebAuthn is a modern shipped module, but the vulnerable configuration requires either the default storage attribute to become attacker-writable, or the WebAuthn userAttribute to be set to an attacker-writable string attribute. That is not the default, but it is feasible in deployments because the product exposes the storage attribute as a free-form admin setting and does not warn or enforce that it must be server-managed and non-user-writable. This may exist through delegated administration, provisioning, write access to the backing LDAP/directory user record, legacy REST self-registration, or unsafe reconfiguration of userAttribute.
In any deployment where the attribute becomes user writable, an attacker can execute arbitrary code as the application server user.
This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.
This page as .md · .json · in your agent: get_signal("CVE-2026-45051")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.