CyberRota Analysis
AI-GeneratedOpen Access Management (OpenAM) versions prior to 16.1.2 are vulnerable to a deserialization flaw in the WebAuthnAuthentication.deserialize method, which allows attackers to exploit serialized objects beyond the intended scope. This can lead to unauthorized execution of code, potentially compromising the integrity of the application. Organizations using affected versions should prioritize upgrading to 16.1.2 to mitigate this critical vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, WebAuthnAuthentication.deserialize applies an ObjectInputFilter that allows every serialized object at depth greater than 1 and therefore constrains only an AuthenticatorImpl root object. A pre-authentication attacker can supply a userHandle whose serialized graph has a valid AuthenticatorImpl root and a nested gadget class, causing readObject or readResolve execution before the cast and assertion verification when a usable gadget is on the classpath. This bypasses the incomplete remediation for the earlier WebAuthn deserialization vulnerability. This issue is fixed in version 16.1.2.