Maven · org.openidentityplatform.openam:openam-auth-webauthn
OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass
The GHSA-6c99-87fr-6q7r fix wrapped WebAuthn authenticator deserialization in an ObjectInputFilter meant to allow only AuthenticatorImpl, but it short-circuits to ALLOWED for any object at stream depth > 1. Because the Java serialization filter is consulted for every class in the graph (and depth == 1 only for the root's concrete class), the allowlist constrains only the root and leaves the entire nested graph unchecked.
An attacker can craft a stream rooted at AuthenticatorImpl with an arbitrary gadget chain nested inside. The gadget's readObject/readResolve executes during readObject() — before the cast and before any assertion verification — enabling remote code execution when a gadget is on the classpath. The deserialization sink is reached pre-authentication via an attacker-chosen userHandle.
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.