---
id: "CVE-2026-45051"
kind: "vulnerability"
aliases: ["CVE-2026-45051", "GHSA-6c99-87fr-6q7r"]
title: "OpenAM: Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage"
severity: "critical"
cvss: 9.2
epss: 0.00688
exploited: false
status: "open"
category: "package"
products: [{"name": "org.openidentityplatform.openam:openam-auth-webauthn", "fixed": ["16.1.1"], "affected": "<= 16.0.6", "ecosystem": "maven"}]
ecosystems: ["maven"]
tags: ["cwe-502", "identity", "java", "openam", "package", "self-hosted", "webauthn"]
not_affected_if: ["default-config", "non-community-edition", "webauthn-disabled"]
published_at: "2026-06-24T17:25:28+00:00"
first_seen_at: "2026-10-28T15:29:41+00:00"
updated_at: "2026-10-28T15:33:37+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-6c99-87fr-6q7r", "first_seen_at": "2026-10-28T15:29:41+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45051", "first_seen_at": "2026-10-28T15:33:37+00:00"}]
---

# OpenAM: Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage

OpenAM's WebAuthn authentication module deserializes data read from a storage attribute without checking it, which is a Java deserialization flaw (CWE-502). If an attacker can write to that attribute and reach the WebAuthn login flow, they can run code as the application server user.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:org.openidentityplatform.openam:openam-auth-webauthn affected <= 16.0.6 fixed 16.1.1

## How to check

- Check the `openam-auth-webauthn` version in the Maven build or deployed WEB-INF/lib; affected versions are `16.0.6` and below.
- Review the WebAuthn `userAttribute` setting and the storage attribute it reads; flag any that users, delegated admins, provisioning, or directory write access can modify.
- Check whether legacy REST self-registration is enabled.

## Fix

- Upgrade OpenAM `openam-auth-webauthn` to `16.1.1`.
- Make the WebAuthn storage attribute server-managed and non-user-writable in the backing LDAP/directory.
- Restrict write access to user records and to the `userAttribute` setting.

## Timeline

- 2026-10-28T15:29:41+00:00 ghsa https://github.com/advisories/GHSA-6c99-87fr-6q7r
- 2026-10-28T15:33:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-45051

## From the sources

## Summary

**Description**

A deserialization of untrusted data vulnerability (CWE-502) exists in OpenAM's WebAuthn authentication module. Under certain conditions, this may allow an attacker to achieve arbitrary code execution in the context of the application server. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1.

This is not the default configuration. Exploitation requires that an attacker has previously been able to write attacker-controlled data to a storage attribute read by the WebAuthn module, and that the WebAuthn authentication flow is reachable.

## Impact
WebAuthn is a modern shipped module, but the vulnerable configuration requires either the default storage attribute to become attacker-writable, or the WebAuthn userAttribute to be set to an attacker-writable string attribute. That is not the default, but it is feasible in deployments because the product exposes the storage attribute as a free-form admin setting and does not warn or enforce that it must be server-managed and non-user-writable. This may exist through delegated administration, provisioning, write access to the backing LDAP/directory user record, legacy REST self-registration, or unsafe reconfiguration of `userAttribute`.

In any deployment where the attribute becomes user writable, an attacker can execute arbitrary code as the application server user. 

## Patch
This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_