Changes.Watch~ upgrade verdicts ~
Free digest
ExploitedPHP2Shell is now on CISA KEV

critical vulnerability

OpenAM: Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage

Fix availableCritical · CVSS 9.2EPSS 0.69%

Published Jun 24, 2026 · updated Oct 28, 2026

What to do

  1. Upgrade to a fixed version: org.openidentityplatform.openam:openam-auth-webauthn 16.1.1.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Mavenorg.openidentityplatform.openam:openam-auth-webauthn

Vulnerable versions
<= 16.0.6
Fixed in
16.1.1

Check your project: mvn dependency:tree -Dincludes=org.openidentityplatform.openam:openam-auth-webauthn

Sources

CWE-502 Deserialization of Untrusted Data

← All critical vulnerabilities