---
id: 3935
title: "GWT: Unpatched, Unauthenticated Java Deserialization"
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/gwt-unpatched-unauthenticated-java-deserialization-vulnerability"
published_at: "2023-12-18T00:00:00Z"
tags: ["rce", "web-framework", "gwt", "java-deserialization", "unpatched-vulnerability"]
phying_url: "https://phying.com/item/3935"
lang: en
---

# GWT: Unpatched, Unauthenticated Java Deserialization

## Summary

Ben Lincoln details an eight-year-old unauthenticated Java deserialization flaw in GWT that remained unpatched in late 2023; GWT 2.10.1/2.11.0 now disable binary serialization by default.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **Published:** 2023-12-18T00:00:00Z
- **Original:** https://bishopfox.com/blog/gwt-unpatched-unauthenticated-java-deserialization-vulnerability
- **Phying News:** https://phying.com/item/3935