CVE-2026-62263
Summary
The GHSA-6c99-87fr-6q7r fix wrapped WebAuthn authenticator deserialization in an ObjectInputFilter meant to allow only AuthenticatorImpl, but it short-circuits to ALLOWED for any object at stream depth > 1. Because the Java serialization filter is consulted for every class in the graph (and depth == 1 only for the root's concrete class), the allowlist constrains only the root and leaves the entire nested graph unchecked.
Impact
An attacker can craft a stream rooted at AuthenticatorImpl with an arbitrary gadget chain nested inside. The gadget's readObject/readResolve executes during readObject() — before the cast and before any assertion verification — enabling remote code execution when a gadget is on the classpath. The deserialization sink is reached pre-authentication via an attacker-chosen userHandle.
⚡ Watch CVE-2026-62263
Get an email if CVE-2026-62263 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Advisory coverage (1)
- criticalGHSA-gf8h-gq53-288j: OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypassghsa · 2026-07-24
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-62263)