OpenIdentityPlatform OpenAM: Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM

🗓️ 07 Apr 2026 15:45:50Reported by GitHub Advisory DatabaseType

OpenAM preauth remote code execution via unsafe deserialization of jato.clientSession, bypassing whitelist.

Reporter	Title	Published	Views	Family All 58
0day.today	ForgeRock Access Manager / OpenAM 14.6.3 - Remote Code Execution (Unauthenticated) Exploit	16 Jul 202100:00	–	zdt
GithubExploit	Exploit for Deserialization of Untrusted Data in Forgerock Access_Management	1 Jul 202103:51	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Openidentityplatform Openam	28 Apr 202607:11	–	githubexploit
ICS	2021 Top Routinely Exploited Vulnerabilities	28 Apr 202212:00	–	ics
ATTACKERKB	CVE-2026-33439	7 Apr 202620:46	–	attackerkb
ATTACKERKB	Pre-auth RCE in ForgeRock Access Manager (CVE-2021-35464)	22 Jul 202100:00	–	attackerkb
Information Security Automation	Last Week’s Security news: PrintNightmare, Kaseya, Intune, Metasploit Docker escape	5 Jul 202115:19	–	avleonov
Information Security Automation	Last Week’s Security news: Exploits for ForgeRock, vSphere, Apache Tomcat, new Print Spooler vuln, Kaseya Patch and REvil, SolarWinds, Schneider Electric, Bulletins	19 Jul 202116:29	–	avleonov
Circl	CVE-2021-35464	29 Jun 202113:17	–	circl
Circl	CVE-2026-33439	7 Apr 202623:20	–	circl

Vulners

Node

Source	Link
github	www.github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-2cqq-rpvq-g5qj
github	www.github.com/OpenIdentityPlatform/OpenAM/commit/014007c63cacc834cc795a89fac0e611aebc4a32
github	www.github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.0.6
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-33439
github	www.github.com/advisories/GHSA-2cqq-rpvq-g5qj

07 Apr 2026 22:16Current

7.6High risk

Vulners AI Score7.6

CVSS 3.19.8

CVSS 210

CVSS 49.3

EPSS0.94386

SSVC