{"id":"CVE-2026-45051","kind":"vulnerability","aliases":["CVE-2026-45051","GHSA-6c99-87fr-6q7r"],"related":[],"title":"OpenAM: Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage","description":"## Summary\n\n**Description**\n\nA deserialization of untrusted data vulnerability (CWE-502) exists in OpenAM's WebAuthn authentication module. Under certain conditions, this may allow an attacker to achieve arbitrary code execution in the context of the application server. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1.\n\nThis is not the default configuration. Exploitation requires that an attacker has previously been able to write attacker-controlled data to a storage attribute read by the WebAuthn module, and that the WebAuthn authentication flow is reachable.\n\n## Impact\nWebAuthn is a modern shipped module, but the vulnerable configuration requires either the default storage attribute to become attacker-writable, or the WebAuthn userAttribute to be set to an attacker-writable string attribute. That is not the default, but it is feasible in deployments because the product exposes the storage attribute as a free-form admin setting and does not warn or enforce that it must be server-managed and non-user-writable. This may exist through delegated administration, provisioning, write access to the backing LDAP/directory user record, legacy REST self-registration, or unsafe reconfiguration of `userAttribute`.\n\nIn any deployment where the attribute becomes user writable, an attacker can execute arbitrary code as the application server user. \n\n## Patch\nThis has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.","summary":"OpenAM's WebAuthn authentication module deserializes data read from a storage attribute without checking it, which is a Java deserialization flaw (CWE-502). If an attacker can write to that attribute and reach the WebAuthn login flow, they can run code as the application server user.","severity":"critical","cvss":9.2,"epss":0.00688,"exploited":false,"exploited_at":null,"products":[{"name":"org.openidentityplatform.openam:openam-auth-webauthn","fixed":["16.1.1"],"affected":"<= 16.0.6","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["cwe-502","identity","java","openam","package","self-hosted","webauthn"],"not_affected_if":["default-config","non-community-edition","webauthn-disabled"],"how_to_check":"- Check the `openam-auth-webauthn` version in the Maven build or deployed WEB-INF/lib; affected versions are `16.0.6` and below.\n- Review the WebAuthn `userAttribute` setting and the storage attribute it reads; flag any that users, delegated admins, provisioning, or directory write access can modify.\n- Check whether legacy REST self-registration is enabled.","fix":"- Upgrade OpenAM `openam-auth-webauthn` to `16.1.1`.\n- Make the WebAuthn storage attribute server-managed and non-user-writable in the backing LDAP/directory.\n- Restrict write access to user records and to the `userAttribute` setting.","status":"open","published_at":"2026-06-24T17:25:28+00:00","first_seen_at":"2026-10-28T15:29:41+00:00","triaged_at":"2026-10-28T15:30:59+00:00","updated_at":"2026-10-28T15:33:37+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T15:30:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenAM `openam-auth-webauthn` to `16.1.1`.\n- Make the WebAuthn storage attribute server-managed and non-user-writable in the backing LDAP/directory.\n- Restrict write access to user records and to the `userAttribute` setting.","reach":"internet","title":"OpenAM: WebAuthn module deserialization lets a writable attribute run code","impact":"high","summary":"OpenAM's WebAuthn authentication module deserializes data read from a storage attribute without checking it, which is a Java deserialization flaw (CWE-502). If an attacker can write to that attribute and reach the WebAuthn login flow, they can run code as the application server user.","category":"package","nicknames":[],"who_cares":["openam","java","self-hosted","webauthn","identity"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker runs arbitrary code as the application server user.","analyst_note":"","how_to_check":"- Check the `openam-auth-webauthn` version in the Maven build or deployed WEB-INF/lib; affected versions are `16.0.6` and below.\n- Review the WebAuthn `userAttribute` setting and the storage attribute it reads; flag any that users, delegated admins, provisioning, or directory write access can modify.\n- Check whether legacy REST self-registration is enabled.","needs_analyst":false,"not_affected_if":["default-config","webauthn-disabled","non-community-edition"],"who_is_affected":"Deployments of OpenAM Community Edition 16.0.6 or earlier that use the WebAuthn module and where the storage attribute can be written by an attacker, through delegated admin, provisioning, directory write access, legacy self-registration, or an unsafe `userAttribute` setting. The vulnerable configuration is not the default, but the product does not enforce that the attribute be server-managed. Teams not running OpenAM or not using WebAuthn can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000731,"input_tokens":3768,"output_tokens":709,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,22A '-45051':15A,23A '-502':30B,61B,94C '16.0.6':129C '16.1.1':135C,308C '6c99':18A '6q7r':20A '87fr':19A 'abl':150C 'access':261C 'achiev':111C 'admin':233C 'administr':258C 'affect':123C 'allow':107C 'applic':82B,120C,295C 'arbitrari':112C,291C 'attack':64B,109C,146C,154C,194C,206C,288C 'attacker-control':153C 'attacker-writ':193C,205C 'attribut':50B,69B,160C,190C,209C,227C,283C 'auth':4A,27A 'authent':11A,42B,100C,170C 'back':264C 'becom':192C,284C 'certain':103C 'check':52B 'code':79B,113C,292C 'communiti':125C,305C 'condit':104C 'configur':141C,184C 'context':117C 'control':155C 'cve':13A,21A 'cwe':29B,60B,93C 'data':45B,91C,156C 'default':140C,188C,214C 'deleg':257C 'deploy':220C,280C 'descript':86C 'deseri':8A,44B,58B,88C 'edit':126C,306C 'either':186C 'encourag':311C 'enforc':240C 'execut':114C,290C 'exist':95C,255C 'exploit':142C 'expos':224C 'feasibl':218C 'flaw':59B 'flow':75B,171C 'form':232C 'free':231C 'free-form':230C 'ghsa':17A 'ghsa-6c99-87fr-6q7r':16A 'host':37B 'ident':31B 'impact':174C 'java':7A,32B,57B 'latest':316C 'ldap/directory':265C 'legaci':268C 'login':74B 'manag':247C 'may':106C,254C 'modern':178C 'modul':43B,101C,165C,180C 'must':243C 'non':250C 'non-user-writ':249C 'openam':1A,26A,33B,39B,97C,124C,304C 'openam-auth-webauthn':25A 'org.openidentityplatform.openam':24A 'packag':34B 'patch':132C,298C,302C 'pre':3A 'pre-auth':2A 'previous':148C 'product':223C 'provis':259C 'rce':5A 'reach':71B 'reachabl':173C 'read':46B,161C 'reconfigur':275C 'record':267C 'registr':272C 'releas':317C 'requir':143C,185C 'rest':269C 'run':78B 'self':36B,271C 'self-host':35B 'self-registr':270C 'server':83B,121C,246C,296C 'server-manag':245C 'set':202C,234C 'ship':179C 'storag':12A,49B,159C,189C,226C 'string':208C 'summari':85C 'unsaf':274C 'untrust':90C 'updat':313C 'user':84B,251C,266C,285C,297C,309C 'userattribut':199C,277C 'version':128C,134C,307C 'via':6A 'vulner':92C,183C 'warn':238C 'webauthn':10A,28A,38B,41B,73B,99C,164C,169C,175C,198C 'without':51B 'writabl':195C,207C,252C,286C 'write':66B,152C,260C","nicknames":[],"mitigations":[],"who_affected":"Deployments of OpenAM Community Edition 16.0.6 or earlier that use the WebAuthn module and where the storage attribute can be written by an attacker, through delegated admin, provisioning, directory write access, legacy self-registration, or an unsafe `userAttribute` setting. The vulnerable configuration is not the default, but the product does not enforce that the attribute be server-managed. Teams not running OpenAM or not using WebAuthn can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-06-24T17:25:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-6c99-87fr-6q7r","url":"https://github.com/advisories/GHSA-6c99-87fr-6q7r","severity":"critical","published_at":"2026-06-24T17:25:28+00:00","modified_at":"2026-10-28T15:25:32+00:00","first_seen_at":"2026-10-28T15:29:41+00:00","fetched_at":"2026-10-28T15:29:41+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-45051","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45051","severity":null,"published_at":"2026-09-15T10:17:04+00:00","modified_at":"2026-09-23T18:21:42+00:00","first_seen_at":"2026-10-28T15:33:37+00:00","fetched_at":"2026-10-28T15:33:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}