Vulnerability-Lookup

CVE-2026-33439 (GCVE-0-2026-33439)

Vulnerability from cvelistv5 – Published: 2026-04-07 20:46 – Updated: 2026-04-08 16:14

Title

Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM

Summary

Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464. An unauthenticated attacker can achieve arbitrary command execution on the server by sending a crafted serialized Java object as the jato.clientSession GET/POST parameter to any JATO ViewBean endpoint whose JSP contains <jato:form> tags (e.g., the Password Reset pages). This vulnerability is fixed in 16.0.6.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-08 16:11 UTC

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/OpenIdentityPlatform/OpenAM/se…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version	CPE status
OpenIdentityPlatform	OpenAM	Affected: < 16.0.6	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33439",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-08T16:11:05.727049Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-08T16:14:49.293Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OpenAM",
          "vendor": "OpenIdentityPlatform",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 16.0.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464. An unauthenticated attacker can achieve arbitrary command execution on the server by sending a crafted serialized Java object as the jato.clientSession GET/POST parameter to any JATO ViewBean endpoint whose JSP contains \u003cjato:form\u003e tags (e.g., the Password Reset pages). This vulnerability is fixed in 16.0.6."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-07T20:46:33.739Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-2cqq-rpvq-g5qj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-2cqq-rpvq-g5qj"
        }
      ],
      "source": {
        "advisory": "GHSA-2cqq-rpvq-g5qj",
        "discovery": "UNKNOWN"
      },
      "title": "Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33439",
    "datePublished": "2026-04-07T20:46:33.739Z",
    "dateReserved": "2026-03-19T18:45:22.438Z",
    "dateUpdated": "2026-04-08T16:14:49.293Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-33439",
      "date": "2026-09-20",
      "epss": "0.10005",
      "percentile": "0.95392"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "OpenAM",
                "vendor": "OpenIdentityPlatform",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 16.0.6"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:openidentityplatform:openam:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "448995F0-D580-4B7A-AF84-7FDB93013B6A",
                    "versionEndExcluding": "16.0.6",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464. An unauthenticated attacker can achieve arbitrary command execution on the server by sending a crafted serialized Java object as the jato.clientSession GET/POST parameter to any JATO ViewBean endpoint whose JSP contains \u003cjato:form\u003e tags (e.g., the Password Reset pages). This vulnerability is fixed in 16.0.6."
          },
          {
            "lang": "es",
            "value": "Open Access Management (OpenAM) es una soluci\u00f3n de gesti\u00f3n de acceso. Antes de la versi\u00f3n 16.0.6, OpenIdentityPlatform OpenAM es vulnerable a la Ejecuci\u00f3n Remota de C\u00f3digo (RCE) de pre-autenticaci\u00f3n a trav\u00e9s de deserializaci\u00f3n Java insegura del par\u00e1metro HTTP jato.clientSession. Esto elude la mitigaci\u00f3n WhitelistObjectInputStream que se aplic\u00f3 al par\u00e1metro jato.pageSession despu\u00e9s de CVE-2021-35464. Un atacante no autenticado puede lograr la ejecuci\u00f3n arbitraria de comandos en el servidor enviando un objeto Java serializado manipulado como el par\u00e1metro GET/POST jato.clientSession a cualquier punto final JATO ViewBean cuyo JSP contiene etiquetas \u003cjato:form\u003e (por ejemplo, las p\u00e1ginas de Restablecimiento de Contrase\u00f1a). Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 16.0.6."
          }
        ],
        "id": "CVE-2026-33439",
        "lastModified": "2026-07-24T23:10:00.563",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 9.3,
                "baseSeverity": "CRITICAL",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-33439",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-08T16:11:05.727049Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-04-07T21:17:17.407",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-2cqq-rpvq-g5qj"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-502"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-06-05T19:17:01+00:00",
      "cve": "CVE-2026-33439",
      "id": "CVE-2026-33439",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33439.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-33439",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-04-08T16:11:05.727049Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-04-08T16:11:09.625Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "OpenAM",
              "vendor": "OpenIdentityPlatform",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 16.0.6"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464. An unauthenticated attacker can achieve arbitrary command execution on the server by sending a crafted serialized Java object as the jato.clientSession GET/POST parameter to any JATO ViewBean endpoint whose JSP contains \u003cjato:form\u003e tags (e.g., the Password Reset pages). This vulnerability is fixed in 16.0.6."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 9.3,
                "baseSeverity": "CRITICAL",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-502",
                  "description": "CWE-502: Deserialization of Untrusted Data",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-04-07T20:46:33.739Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-2cqq-rpvq-g5qj",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-2cqq-rpvq-g5qj"
            }
          ],
          "source": {
            "advisory": "GHSA-2cqq-rpvq-g5qj",
            "discovery": "UNKNOWN"
          },
          "title": "Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-33439",
        "datePublished": "2026-04-07T20:46:33.739Z",
        "dateReserved": "2026-03-19T18:45:22.438Z",
        "dateUpdated": "2026-04-08T16:14:49.293Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-33439

Vulnerability from fkie_nvd - Published: 2026-04-07 21:17 - Updated: 2026-07-24 23:10

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-2cqq-rpvq-g5qj	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	openidentityplatform	openam	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "OpenAM",
          "vendor": "OpenIdentityPlatform",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 16.0.6"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openidentityplatform:openam:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "448995F0-D580-4B7A-AF84-7FDB93013B6A",
              "versionEndExcluding": "16.0.6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464. An unauthenticated attacker can achieve arbitrary command execution on the server by sending a crafted serialized Java object as the jato.clientSession GET/POST parameter to any JATO ViewBean endpoint whose JSP contains \u003cjato:form\u003e tags (e.g., the Password Reset pages). This vulnerability is fixed in 16.0.6."
    },
    {
      "lang": "es",
      "value": "Open Access Management (OpenAM) es una soluci\u00f3n de gesti\u00f3n de acceso. Antes de la versi\u00f3n 16.0.6, OpenIdentityPlatform OpenAM es vulnerable a la Ejecuci\u00f3n Remota de C\u00f3digo (RCE) de pre-autenticaci\u00f3n a trav\u00e9s de deserializaci\u00f3n Java insegura del par\u00e1metro HTTP jato.clientSession. Esto elude la mitigaci\u00f3n WhitelistObjectInputStream que se aplic\u00f3 al par\u00e1metro jato.pageSession despu\u00e9s de CVE-2021-35464. Un atacante no autenticado puede lograr la ejecuci\u00f3n arbitraria de comandos en el servidor enviando un objeto Java serializado manipulado como el par\u00e1metro GET/POST jato.clientSession a cualquier punto final JATO ViewBean cuyo JSP contiene etiquetas \u003cjato:form\u003e (por ejemplo, las p\u00e1ginas de Restablecimiento de Contrase\u00f1a). Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 16.0.6."
    }
  ],
  "id": "CVE-2026-33439",
  "lastModified": "2026-07-24T23:10:00.563",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-33439",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-08T16:11:05.727049Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-07T21:17:17.407",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-2cqq-rpvq-g5qj"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-2CQQ-RPVQ-G5QJ

Vulnerability from github – Published: 2026-04-07 15:45 – Updated: 2026-04-07 22:16

Summary

OpenIdentityPlatform OpenAM: Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM

Details

Summary

OpenIdentityPlatform OpenAM 16.0.5 (and likely earlier versions) is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464.

An unauthenticated attacker can achieve arbitrary command execution on the server by sending a crafted serialized Java object as the jato.clientSession GET/POST parameter to any JATO ViewBean endpoint whose JSP contains <jato:form> tags (e.g., the Password Reset pages).

Vulnerability Details

Background

CVE-2021-35464 identified that the jato.pageSession HTTP parameter was deserialized without class filtering, allowing pre-auth RCE.

OpenIdentityPlatform OpenAM mitigated this by introducing WhitelistObjectInputStream in ConsoleViewBeanBase.deserializePageAttributes(), which restricts jato.pageSession deserialization to a hardcoded whitelist of ~40 safe classes.

However, the JATO framework contains a second deserialization entry point — jato.clientSession — handled by ClientSession.deserializeAttributes(). This code path was not patched and still uses the unfiltered Encoder.deserialize() → ApplicationObjectInputStream, which performs ObjectInputStream.readObject() with no class whitelist.

Root Cause

ClientSession.deserializeAttributes()
  → Encoder.deserialize()
    → ApplicationObjectInputStream.readObject()  // VULNERABLE — no whitelist

The ClientSession object is instantiated in RequestContextImpl.getClientSession() with the raw jato.clientSession parameter value from the HTTP request. Deserialization is triggered during JSP rendering when <jato:form> tags invoke getClientSession() → hasAttributes() → getEncodedString() → isValid() → ensureAttributes() → deserializeAttributes().

Affected Code

File: com/iplanet/jato/ClientSession.java

protected ClientSession(RequestContext context) {
    this.encodedSessionString =
        context.getRequest().getParameter("jato.clientSession");
}

protected void deserializeAttributes() {
    if (this.encodedSessionString != null
        && this.encodedSessionString.trim().length() > 0) {
        this.setAttributes(
            (Map) Encoder.deserialize(
                Encoder.decodeHttp64(this.encodedSessionString), false)
        );
    }
}

Gadget Chain

The exploit uses classes bundled in the OpenAM WAR:

PriorityQueue.readObject()                        [java.util — JDK]
  → heapify() → siftDown() → comparator.compare()
    → Column$ColumnComparator.compare()            [openam-core-16.0.5.jar]
      → Column.getProperty()
        → PropertyUtils.getObjectPropertyValue()   [openam-core-16.0.5.jar]
          → Method.invoke(TemplatesImpl, "getOutputProperties")
            → TemplatesImpl.getOutputProperties()  [xalan-2.7.3.jar]
              → newTransformer() → defineTransletClasses()
                → TransletClassLoader.defineClass(_bytecodes)
                  → _class[_transletIndex].newInstance()
                    → EvilTranslet.<clinit>()      [attacker bytecode]
                      → Runtime.getRuntime().exec(cmd)

Impact

Pre-authentication — no credentials or session tokens required
Remote Code Execution — arbitrary OS commands as the application server user
Full server compromise, lateral movement, data exfiltration
Affects any deployment with at least one accessible JATO endpoint whose JSP renders <jato:form> tags (e.g., Password Reset pages)

Tested Environment

OpenIdentityPlatform OpenAM 16.0.5 (official release WAR from GitHub)
Apache Tomcat 10.1.52
Java 21.0.7 (Oracle JDK)
macOS / Linux (aarch64)
Also verified on openidentityplatform/openam:latest Docker image (Java 25)

Affected Versions

OpenIdentityPlatform OpenAM 16.0.5 (confirmed on both Docker and bare-metal Tomcat)
Likely all versions that left ClientSession.deserializeAttributes() unpatched

Remediation

Apply WhitelistObjectInputStream filtering to ClientSession.deserializeAttributes(), matching the mitigation already applied to ConsoleViewBeanBase.deserializePageAttributes()
Audit all callers of Encoder.deserialize() for user-controlled input
Consider adding a JVM-wide JEP 290 deserialization filter as defense-in-depth

References

CVE-2021-35464 — Pre-auth RCE in ForgeRock OpenAM (PortSwigger Research)
https://portswigger.net/research/pre-auth-rce-in-forgerock-openam-cve-2021-35464
CWE-502: Deserialization of Untrusted Data

Credit

This finding was discovered by Rahul Maini and Hacktron AI while auditing OpenIdentityPlatform OpenAM. Hacktron AI is our white-box pentest solution, designed to deliver high-accuracy results with minimal false positives.

Disclosure Policy

This bug is subject to a 90-day disclosure deadline. If a fix for this issue is made available to users before the end of the 90-day deadline, this bug report will become public on the day that the fix was made available or an earlier or later date if agreed by both parties. Otherwise, this bug report will become public at the deadline.

If another researcher discloses the proof-of-concept before any deadlines, we reserve the right to publish our findings.

The details of this bug may be privately disclosed to vulnerable parties, including but not limited to Hacktron AI's customers.

Severity

9.3 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 16.0.5"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.openidentityplatform.openam:openam"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "16.0.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33439"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-07T15:45:50Z",
    "nvd_published_at": "2026-04-07T21:17:17Z",
    "severity": "CRITICAL"
  },
  "details": "## Summary\n\nOpenIdentityPlatform OpenAM 16.0.5 (and likely earlier versions) is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the `jato.clientSession` HTTP parameter. This bypasses the `WhitelistObjectInputStream` mitigation that was applied to the `jato.pageSession` parameter after CVE-2021-35464.\n\nAn unauthenticated attacker can achieve arbitrary command execution on the server by sending a crafted serialized Java object as the `jato.clientSession` GET/POST parameter to any JATO ViewBean endpoint whose JSP contains `\u003cjato:form\u003e` tags (e.g., the Password Reset pages).\n\n---\n\n## Vulnerability Details\n\n### Background\n\nCVE-2021-35464 identified that the `jato.pageSession` HTTP parameter was deserialized without class filtering, allowing pre-auth RCE.\n\nOpenIdentityPlatform OpenAM mitigated this by introducing `WhitelistObjectInputStream` in `ConsoleViewBeanBase.deserializePageAttributes()`, which restricts `jato.pageSession` deserialization to a hardcoded whitelist of ~40 safe classes.\n\nHowever, the JATO framework contains a **second deserialization entry point** \u2014 `jato.clientSession` \u2014 handled by `ClientSession.deserializeAttributes()`. This code path was **not patched** and still uses the unfiltered `Encoder.deserialize()` \u2192 `ApplicationObjectInputStream`, which performs `ObjectInputStream.readObject()` with no class whitelist.\n\n### Root Cause\n\n```\nClientSession.deserializeAttributes()\n  \u2192 Encoder.deserialize()\n    \u2192 ApplicationObjectInputStream.readObject()  // VULNERABLE \u2014 no whitelist\n```\n\nThe `ClientSession` object is instantiated in `RequestContextImpl.getClientSession()` with the raw `jato.clientSession` parameter value from the HTTP request. Deserialization is triggered during JSP rendering when `\u003cjato:form\u003e` tags invoke `getClientSession()` \u2192 `hasAttributes()` \u2192 `getEncodedString()` \u2192 `isValid()` \u2192 `ensureAttributes()` \u2192 `deserializeAttributes()`.\n\n### Affected Code\n\n**File:** `com/iplanet/jato/ClientSession.java`\n```java\nprotected ClientSession(RequestContext context) {\n    this.encodedSessionString =\n        context.getRequest().getParameter(\"jato.clientSession\");\n}\n\nprotected void deserializeAttributes() {\n    if (this.encodedSessionString != null\n        \u0026\u0026 this.encodedSessionString.trim().length() \u003e 0) {\n        this.setAttributes(\n            (Map) Encoder.deserialize(\n                Encoder.decodeHttp64(this.encodedSessionString), false)\n        );\n    }\n}\n```\n\n### Gadget Chain\n\nThe exploit uses classes bundled in the OpenAM WAR:\n\n```\nPriorityQueue.readObject()                        [java.util \u2014 JDK]\n  \u2192 heapify() \u2192 siftDown() \u2192 comparator.compare()\n    \u2192 Column$ColumnComparator.compare()            [openam-core-16.0.5.jar]\n      \u2192 Column.getProperty()\n        \u2192 PropertyUtils.getObjectPropertyValue()   [openam-core-16.0.5.jar]\n          \u2192 Method.invoke(TemplatesImpl, \"getOutputProperties\")\n            \u2192 TemplatesImpl.getOutputProperties()  [xalan-2.7.3.jar]\n              \u2192 newTransformer() \u2192 defineTransletClasses()\n                \u2192 TransletClassLoader.defineClass(_bytecodes)\n                  \u2192 _class[_transletIndex].newInstance()\n                    \u2192 EvilTranslet.\u003cclinit\u003e()      [attacker bytecode]\n                      \u2192 Runtime.getRuntime().exec(cmd)\n```\n\n---\n\n## Impact\n\n- **Pre-authentication** \u2014 no credentials or session tokens required\n- **Remote Code Execution** \u2014 arbitrary OS commands as the application server user\n- Full server compromise, lateral movement, data exfiltration\n- Affects any deployment with at least one accessible JATO endpoint whose JSP renders `\u003cjato:form\u003e` tags (e.g., Password Reset pages)\n\n---\n\n## Tested Environment\n\n- OpenIdentityPlatform OpenAM 16.0.5 (official release WAR from GitHub)\n- Apache Tomcat 10.1.52\n- Java 21.0.7 (Oracle JDK)\n- macOS / Linux (aarch64)\n- Also verified on `openidentityplatform/openam:latest` Docker image (Java 25)\n\n## Affected Versions\n\n- OpenIdentityPlatform OpenAM 16.0.5 (confirmed on both Docker and bare-metal Tomcat)\n- Likely all versions that left `ClientSession.deserializeAttributes()` unpatched\n\n---\n\n## Remediation\n\n1. Apply `WhitelistObjectInputStream` filtering to `ClientSession.deserializeAttributes()`, matching the mitigation already applied to `ConsoleViewBeanBase.deserializePageAttributes()`\n2. Audit all callers of `Encoder.deserialize()` for user-controlled input\n3. Consider adding a JVM-wide JEP 290 deserialization filter as defense-in-depth\n\n---\n\n## References\n\n- CVE-2021-35464 \u2014 Pre-auth RCE in ForgeRock OpenAM (PortSwigger Research)\n- https://portswigger.net/research/pre-auth-rce-in-forgerock-openam-cve-2021-35464\n- CWE-502: Deserialization of Untrusted Data\n\n---\n\n## Credit\n\nThis finding was discovered by **Rahul Maini and Hacktron AI** while auditing OpenIdentityPlatform OpenAM. Hacktron AI is our white-box pentest solution, designed to deliver high-accuracy results with minimal false positives.\n\n---\n\n## Disclosure Policy\n\nThis bug is subject to a 90-day disclosure deadline. If a fix for this issue is made available to users before the end of the 90-day deadline, this bug report will become public on the day that the fix was made available or an earlier or later date if agreed by both parties. Otherwise, this bug report will become public at the deadline.\n\nIf another researcher discloses the proof-of-concept before any deadlines, we reserve the right to publish our findings.\n\nThe details of this bug may be privately disclosed to vulnerable parties, including but not limited to Hacktron AI\u0027s customers.",
  "id": "GHSA-2cqq-rpvq-g5qj",
  "modified": "2026-04-07T22:16:49Z",
  "published": "2026-04-07T15:45:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-2cqq-rpvq-g5qj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33439"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenIdentityPlatform/OpenAM/commit/014007c63cacc834cc795a89fac0e611aebc4a32"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/OpenIdentityPlatform/OpenAM"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.0.6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenIdentityPlatform OpenAM: Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-33439 (GCVE-0-2026-33439)

FKIE_CVE-2026-33439

GHSA-2CQQ-RPVQ-G5QJ

Summary

Vulnerability Details

Background

Root Cause

Affected Code

Gadget Chain

Impact

Tested Environment

Affected Versions

Remediation

References

Credit

Disclosure Policy

Tags

Sightings

Nomenclature

Related by attack behaviour