Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, WebAuthnAuthentication.deserialize applies an ObjectInputFilter that allows every serialized object at depth greater than 1 and therefore constrains only an AuthenticatorImpl root object. A pre-authentication attacker can supply a userHandle whose serialized graph has a valid AuthenticatorImpl root and a nested gadget class, causing readObject or readResolve execution before the cast and assertion verification when a usable gadget is on the classpath. This bypasses the incomplete remediation for the earlier WebAuthn deserialization vulnerability. This issue is fixed in version 16.1.2.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2,     WebAuthnAuthentication.deserialize applies an ObjectInputFilter that allows every serialized object at     depth greater than 1 and therefore constrains only an AuthenticatorImpl root object. A pre-authentication     attacker can supply a userHandle whose serialized graph has a valid AuthenticatorImpl root and a nested     gadget class, causing readObject or readResolve execution before the cast and assertion verification when     a usable gadget is on the classpath. This bypasses the incomplete remediation for the earlier WebAuthn     deserialization vulnerability. This issue is fixed in version 16.1.2. (CVE-2026-62263)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2,
    WebAuthnAuthentication.deserialize applies an ObjectInputFilter that allows every serialized object at
    depth greater than 1 and therefore constrains only an AuthenticatorImpl root object. A pre-authentication
    attacker can supply a userHandle whose serialized graph has a valid AuthenticatorImpl root and a nested
    gadget class, causing readObject or readResolve execution before the cast and assertion verification when
    a usable gadget is on the classpath. This bypasses the incomplete remediation for the earlier WebAuthn
    deserialization vulnerability. This issue is fixed in version 16.1.2. (CVE-2026-62263)

ID	Name	Product	Family	Type	Severity
346352	Linux Distros Unpatched Vulnerability : CVE-2026-62263	Nessus	Misc.	Local	critical
445369	SCA: security update for org.openidentityplatform.openam:openam-auth-webauthn (GHSA-gf8h-gq53-288j)	Tenable Cloud Security	SCA Checks	Local	critical
445369	SCA: security update for org.openidentityplatform.openam:openam-auth-webauthn (GHSA-gf8h-gq53-288j)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-62263

critical

Tenable Plugins

critical

critical

critical