CVE-2026-33439

Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464. An unauthenticated attacker can achieve arbitrary command execution on the server by sending a crafted serialized Java object as the jato.clientSession GET/POST parameter to any JATO ViewBean endpoint whose JSP contains <jato:form> tags (e.g., the Password Reset pages). This vulnerability is fixed in 16.0.6.

• CWE-502

• https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-2cqq-rpvq-g5qjExploit, Vendor Advisory

Published

Apr 7, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33433Traefik is an HTTP reverse proxy and load balancer. Prior to…8.8
• CVE-2026-33434Wazuh is a free and open source platform used for threat pre…7.1
• CVE-2026-33435Weblate is a web based localization tool. In versions prior …8
• CVE-2026-33436Stirling-PDF is a locally hosted web application that facili…6.1
• CVE-2026-33437Stirling-PDF is a locally hosted web application that facili…8.1
• CVE-2026-33438Stirling-PDF is a locally hosted web application that allows…6.5
• CVE-2026-3344A vulnerability in WatchGuard Fireware OS may allow an attac…4.9
• CVE-2026-33440Weblate is a web based localization tool. In versions prior …5
• CVE-2026-33441Rejected reason: This CVE is a duplicate of another CVE: CVE…
• CVE-2026-33442Kysely is a type-safe TypeScript SQL query builder. In versi…8.1
• CVE-2026-33443CVE-2026-33443 is a memory management error in Secure Access…5.9
• CVE-2026-33444CVE-2026-33444 is a memory management vulnerability in Secur…3.7