Skip to content
Threat Feed
Subscribe

Product

Openam-Auth-Webauthn

1 brief RSS
critical advisory

Critical Unauthenticated Remote Code Execution in OpenAM WebAuthn due to Deserialization Vulnerability (CVE-2026-62263)

A critical remote code execution (RCE) vulnerability, CVE-2026-62263, exists in OpenAM's WebAuthn authenticator deserialization, allowing an unauthenticated attacker to bypass an `ObjectInputFilter` and execute arbitrary code by crafting a malicious serialized stream before authentication.

openam-auth-webauthn deserialization rce webauthn java openam vulnerability
2t