OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass
The GHSA-6c99-87fr-6q7r fix wrapped WebAuthn authenticator deserialization in an ObjectInputFilter meant to allow only AuthenticatorImpl, but it short-circuits to ALLOWED for any object at stream depth > 1. Because the Java serialization filter is consulted for every class in the graph (and depth == 1 only for the root's concrete class), the allowlist constrains only the root and leaves the entire nested graph unchecked.
An attacker can craft a stream rooted at AuthenticatorImpl with an arbitrary gadget chain nested inside. The gadget's readObject/readResolve executes during readObject() — before the cast and before any assertion verification — enabling remote code execution when a gadget is on the classpath. The deserialization sink is reached pre-authentication via an attacker-chosen userHandle.
Why this VPI (explainable, experimental)
VPI breakdown
| Impact(default (no data)) | 55.00 |
| Exploitation signal(No additional exploitation signal) | ×1.00 |
| VPI | 55.00 |
VPI formula vpi-v1