CVE-2026-45794: OpenAM has Unsafe Java Deserialization via SNS
(updated )
Description
A Deserialization of Untrusted Data (CWE-502) issue exists in OpenAM’s Push Notification SNS callback resource. The REST route that handles SNS push messages is mounted with anonymous access and, when a supplied message identifier has expired from the in-memory dispatcher, falls back to a CTS-stored predicate blob whose top-level keys are treated as Java class names and passed to Class.forName(…) before attacker-controlled JSON is deserialized via Jackson. This impacts OpenAM Community Edition through version 16.0.6. This issue was patched in version 16.1.1.
Arbitrary attacker-controlled code execution was not confirmed on tested stock classpaths for the latest release, but the flaw yields a reliable class-loading and Jackson-construction primitive whose impacts include remotely triggerable process execution, file writes, and DoS, depending on the deployment’s classpath and environment.
References
- github.com/OpenIdentityPlatform/OpenAM/commit/ca15cba9210f17c0f839b1c148964e1a3dc4a8ca
- github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1
- github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-pp89-732f-3g8q
- github.com/advisories/GHSA-pp89-732f-3g8q
- nvd.nist.gov/vuln/detail/CVE-2026-45794
Code Behaviors & Features
Detect and mitigate CVE-2026-45794 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →