CVE-2026-45051 OpenIdentityPlatform CVE debrief

Who should care

Administrators and security teams responsible for OpenAM deployments should assess exposure and prioritize remediation to prevent potential compromise. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

CVE-2026-45051 is a critical vulnerability in OpenAM that allows for deserialization of untrusted data, potentially leading to code execution. Administrators and security teams should assess exposure and prioritize remediation to prevent potential compromise.

• Potential code execution in the application server process
• Elevation of privileges through deserialization of untrusted data
• Compromise of OpenAM instances with specific configurations
• Verification of OpenAM version and configuration required

Technical summary

The WebAuthnAuthentication module in OpenAM loads a serialized AuthenticatorImpl object graph from a user attribute without an ObjectInputFilter, allowing for potential code execution when specific non-default conditions are met, including the WebAuthn flow being reachable and an attacker having previously written controlled data to that attribute through delegated administration, provisioning, directory access, legacy REST self-registration, or unsafe configuration. This issue is fixed in version 16.1.1, and administrators should assess exposure and prioritize remediation.

Defensive priority

High

Recommended defensive actions

• Upgrade OpenAM to version 16.1.1 or later
• Restrict access to the WebAuthn flow
• Monitor user attributes for suspicious activity
• Implement additional security measures to prevent exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in OpenAM. The issue is fixed in version 16.1.1. Exploitation requires specific conditions to be met, including the WebAuthn flow being reachable and an attacker having previously written controlled data to a user attribute. The vulnerability allows for deserialization of untrusted data, potentially leading to code execution in the application server process.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.