Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.openidentityplatform.openam:openam

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.3MavenPublished

    OpenIdentityPlatform OpenAM: Pre-Authentication Remote Code Execution via jato.clientSession Deserialization in OpenAM

    CVE-2026-33439 · GHSA-2cqq-rpvq-g5qj

    Affected
    • Maven org.openidentityplatform.openam:openam <= 16.0.5
    Fixed in
    16.0.6· Vendor fix available
    Issue
    OpenIdentityPlatform OpenAM 16.0.5 (and likely earlier versions) is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464. An unauthenticated attacker can achieve arbitrary command execution on the server by sending a crafted serialized Java object as the jato.clientSession GET/POST parameter to any JATO ViewBean endpoint whose JSP contains <jato:form tags (e.g., the Password Reset pages). --- Vulnerability Details Background CVE-2021-35464 identified that the jato.pageSession HTTP parameter was deserialized without class filtering, allowing pre-auth RCE. OpenIdentityPlatform OpenAM mitigated this by introducing WhitelistObjectInputStream in ConsoleViewBeanBase.deserializePageAttributes(), which restricts jato.pageSession deserialization to a hardcoded whitelist of ~40…

    Recommended action: Upgrade to 16.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →