WebAuthn Java Deserialization RCE: CVE-2026-02263

CVE-2026-02263: WebAuthn Java Deserialization RCE Vulnerability Summary Vulnerability Overview CVE ID: CVE-2026-02263 Vulnerability Type: WebAuthn Java Deserialization Remote Code Execution (RCE) Root Cause: Insufficient depth checking in ; an attacker can construct malicious serialized data and exploit whitelisted classes such as as "springboards" to bypass the depth limit, thereby triggering arbitrary code execution. Scope of Impact Affected Component: (within the module) Affected Version: 16.1.2 (Fixed in commit , committed on 2026-07-20) Trigger Path: When deserializes the field, if the depth of the object graph exceeds the threshold and includes non-whitelisted classes, it is rejected. Prior to the fix, this depth check could be bypassed. Fix Details 1. Introduction of depth limit: In , wrap the and set an on the deserialization stream. 2. Whitelisted Class Set: permits only fundamental JDK classes such as , , and . 3. Depth and Class Name Validation Logic: - If and the class is not in the whitelist → - If the class name starts with but is not in → - The root object (depth=1) must be or its subclass; otherwise, it is rejected. 4. Test Coverage: Added the test case in to verify that non-whitelisted classes are rejected. Key Code (POC / Fix Code) 1. Whitelist Definition ( ) 2. Deserialization Filter Logic ( ) 3. Test Case ( ) Exploitation Strategy (POC Approach) An attacker constructs a serialized stream where the object graph depth exceeds 1 and includes a non-whitelisted class (e.g., as a springboard). Prior to the fix, the depth check could be bypassed, allowing the constructors or method calls during deserialization to be triggered, thereby achieving RCE.

Goal Reached Thanks to every supporter — we hit 100%!

WebAuthn Java Deserialization RCE: CVE-2026-02263

More from this source