OpenAM versions before 16.1.1 have a vulnerability in the anonymous Push Notification SNS callback handled by SnsMessageResource. When a messageId expires from the in-memory dispatcher, the system falls back to a CTS predicate blob, treating top-level blob keys as Java class names for Class.forName and deserializing attacker-controlled JSON via Jackson. A low-privileged user who initiates Push Registration and obtains the messageId, shared secret, and challenge can wait for expiry, replace the persistent blob through anonymous callbacks, and trigger class loading and object construction in the JVM. This can lead to classpath-dependent process execution, file writes, or denial of service, although command execution was not confirmed on the tested stock classpath. The vulnerability is resolved in OpenAM version 16.1.1.

The vulnerability allows a low-privileged user to exploit unsafe deserialization to cause class loading and object construction in the OpenAM JVM. This can result in process execution dependent on the classpath, file writes, or denial of service. However, direct command execution was not confirmed on the tested default classpath, limiting the confirmed impact to these behaviors.

Upgrade OpenAM to version 16.1.1 or later where this vulnerability is fixed. No other mitigation or temporary workaround is indicated.