{"action":"Upgrade org.openidentityplatform.openam:openam-auth-webauthn to 16.1.2 or later.","affected":[{"fixed":"16.1.2","introduced":"0"}],"component":"org.openidentityplatform.openam:openam-auth-webauthn","cve_ids":["CVE-2026-62263"],"ecosystem":"Maven","epss":0.0086,"exploited":false,"fixed_versions":["16.1.2"],"ghsa_id":"GHSA-gf8h-gq53-288j","id":"tcs_01M5N8Y442A99M2GA7X7ZREV3Q","modified_at":"2026-07-24T21:26:41.828248Z","published_at":"2026-07-24T21:08:46Z","references":["https://osv.dev/vulnerability/GHSA-gf8h-gq53-288j","https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-gf8h-gq53-288j","https://github.com/OpenIdentityPlatform/OpenAM/commit/9dd0fbe07f70f118cf45042d3a9ffb32f3c21e08","https://github.com/OpenIdentityPlatform/OpenAM","https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.2"],"severity":{"label":"critical","score":9.2},"sources":[{"source":"osv","source_id":"GHSA-gf8h-gq53-288j","url":"https://osv.dev/vulnerability/GHSA-gf8h-gq53-288j"},{"source":"nvd","source_id":"CVE-2026-62263","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62263"}],"summary":"OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass"}