CVE-2026-45051: OpenAM Remote Code Execution Vulnerability

CRITICAL
Advisory Identifier: GHSA-6c99-87fr-6q7r
Share
CWE-502
Published
Advisory Summary

CVE-2026-45051 is a CRITICAL remote code execution vulnerability (CWE-502: Deserialization of Untrusted Data) affecting OpenAM libraries in the Maven ecosystem. The issue involves pre-auth rce via java deserialization in webauthn authenticator storage. Remediation is available by upgrading affected packages to version 16.1.1.

CVE-2026-45051 at a Glance

CVE Identifier CVE-2026-45051
GHSA Identifier GHSA-6c99-87fr-6q7r
Severity CRITICAL
CVSS v3.1 Base Score N/A
CWE Classification CWE-502: Deserialization of Untrusted Data
Affected Product OpenAM
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-45051

To remediate this vulnerability, upgrade all affected OpenAM dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

org.openidentityplatform.openam:openam-auth-webauthn fixed: 16.1.1 
<dependency>
    <groupId>org.openidentityplatform.openam</groupId>
    <artifactId>openam-auth-webauthn</artifactId>
    <version>16.1.1</version>
</dependency>
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree -Dincludes=org.openidentityplatform.openam

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-45051, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree -Dincludes=org.openidentityplatform.openam

Analyze the terminal output to locate any version of OpenAM in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 16.1.1), your application is affected.

Note: The mvn dependency:tree -Dincludes=org.openidentityplatform.openam command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-502: Deserialization of Untrusted Data, where the product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. In OpenAM, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

## Summary **Description** A deserialization of untrusted data vulnerability (CWE-502) exists in OpenAM's WebAuthn authentication module. Under certain conditions, this may allow an attacker to achieve arbitrary code execution in the context of the application server. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1. This is not the default configuration. Exploitation requires that an attacker has previously been able to write attacker-controlled data to a storage attribute read by the WebAuthn module, and that the WebAuthn authentication flow is reachable. ## Impact WebAuthn is a modern shipped module, but the vulnerable configuration requires either the default storage attribute to become attacker-writable, or the WebAuthn userAttribute to be set to an attacker-writable string attribute. That is not the default, but it is feasible in deployments because the product exposes the storage attribute as a free-form admin setting and does not warn or enforce that it must be server-managed and non-user-writable. This may exist through delegated administration, provisioning, write access to the backing LDAP/directory user record, legacy REST self-registration, or unsafe reconfiguration of `userAttribute`. In any deployment where the attribute becomes user writable, an attacker can execute arbitrary code as the application server user. ## Patch This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.

CVE-2026-45051 Affected OpenAM Versions

1 component(s)
Fixed Versions:
16.1.1
Product / Package Ecosystem Affected Versions Fixed Version
org.openidentityplatform.openam:openam-auth-webauthn
maven/org.openidentityplatform.openam/openam-auth-webauthn
Maven
< 16.1.1
16.1.1

References

GitHub Advisory / Wiki ADVISORY
https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-6c99-87fr-6q7r
OpenAM Source Repository REPOSITORY
https://github.com/OpenIdentityPlatform/OpenAM

Frequently Asked Questions

What is CVE-2026-45051?
CVE-2026-45051 is a security vulnerability in OpenAM involving Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage under CWE-502: Deserialization of Untrusted Data.
Which OpenAM versions are affected?
Affected versions include releases prior to 16.1.1 across affected packages: org.openidentityplatform.openam:openam-auth-webauthn.
What version fixes CVE-2026-45051?
Upgrading to 16.1.1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is openam-auth-webauthn affected?
Yes, org.openidentityplatform.openam:openam-auth-webauthn is affected in releases prior to 16.1.1. Upgrade your dependency to 16.1.1 or later.
What CWE is associated with CVE-2026-45051?
CVE-2026-45051 is classified under CWE-502: Deserialization of Untrusted Data (The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.).
How can I check Maven dependencies for CVE-2026-45051?
Run the dependency tree command: 'mvn dependency:tree -Dincludes=org.openidentityplatform.openam'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-6c99-87fr-6q7r",
  "modified" : "2026-06-24T17:25:28Z",
  "published" : "2026-06-24T17:25:28Z",
  "aliases" : [ "CVE-2026-45051" ],
  "summary" : "OpenAM: Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage",
  "details" : "## Summary\n\n**Description**\n\nA deserialization of untrusted data vulnerability (CWE-502) exists in OpenAM's WebAuthn authentication module. Under certain conditions, this may allow an attacker to achieve arbitrary code execution in the context of the application server. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1.\n\nThis is not the default configuration. Exploitation requires that an attacker has previously been able to write attacker-controlled data to a storage attribute read by the WebAuthn module, and that the WebAuthn authentication flow is reachable.\n\n## Impact\nWebAuthn is a modern shipped module, but the vulnerable configuration requires either the default storage attribute to become attacker-writable, or the WebAuthn userAttribute to be set to an attacker-writable string attribute. That is not the default, but it is feasible in deployments because the product exposes the storage attribute as a free-form admin setting and does not warn or enforce that it must be server-managed and non-user-writable. This may exist through delegated administration, provisioning, write access to the backing LDAP/directory user record, legacy REST self-registration, or unsafe reconfiguration of `userAttribute`.\n\nIn any deployment where the attribute becomes user writable, an attacker can execute arbitrary code as the application server user. \n\n## Patch\nThis has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.openidentityplatform.openam:openam-auth-webauthn"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "16.1.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 16.0.6"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-6c99-87fr-6q7r"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/OpenIdentityPlatform/OpenAM"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-502" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-24T17:25:28Z",
    "nvd_published_at" : null
  }
}