CVE-2026-33439criticalCWE-502

CVE-2026-33439: critical vulnerability in OpenIdentityPlatform OpenAM

Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM

Published · Updated

Follow this CVE+ Monitor OpenAM+ Monitor org.openidentityplatform.openam:openam

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 9.3epss 9.3%
Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464. An unauthenticated attacker can achieve arbitrary command execution on the server by sending a crafted serialized Java object as the jato.clientSession GET/POST parameter to any JATO ViewBean endpoint whose JSP contains <jato:form> tags (e.g., the Password Reset pages). This vulnerability is fixed in 16.0.6.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
OpenIdentityPlatform · OpenAM
Related CVEs — OpenIdentityPlatform OpenAM

In the same product, most dangerous first.

CVE-2024-41667HIGHOpenAM FreeMarker template injectionEPSS 3.5%CVE-2023-37471CRITICALUser impersonation using SAMLv1.x SSO in Open Access Management EPSS 1.3%CVE-2026-62379CRITICALOpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallbackEPSS 1.1%CVE-2026-46619CRITICALOpenAM Authentication Bypass via MSISDN LDAP InjectionEPSS 1.0%CVE-2026-62263CRITICALOpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypassEPSS 0.9%CVE-2026-45052CRITICALOpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery EndpointsEPSS 0.8%