CVE-2021-29156

CVE-2021-29156 Proof-of-Concept c 2021 GuidePoint Security Charlton Trezevant [email protected] Contesto Oggi GuidePoint è lieta di rilasciare uno strumento Proof-of-Concept funzionante per CVE-2021-29156, una vulnerabilità di iniezione LDAP in ForgeRock OpenAM v13.0.0. Questa vulnerabilità...

OpenAM <= 16.0.5 - Pre-Auth RCE via jato.clientSession Deserialization

Open Access Management OpenAM is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution RCE via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream...

OpenAM<=15.0.3 FreeMarker - Template Injection

OpenAM is an open access management solution. In versions 15.0.3 and prior, the getCustomLoginUrlTemplate method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input id: CVE-2024-41667 info: name: OpenAM=15.0.3 FreeMarker - Template Injection...

LDAP Injection In OpenAM

OpenAM contains an LDAP injection vulnerability. When a user tries to reset his password, they are asked to enter username, and then the backend validates whether the user exists or not through an LDAP query. If the user exists, the password reset token is sent to the user's email. Enumeration ca...

openam-CVE-2021-35464

openam CVE-2021-35464 Esecuzione di comandi con echo su tomcat. Il progetto si basa su ysoserial e Java-Rce-Echo Per compilare il progetto è necessario aggiungere ysoserial.jar e jato-14.6.3.jar alle dipendenze. root@kitploit: POST /OpenAM/ccversion/Version HTTP/1.1 Host: php.local:8081...

CVE-2026-33439

🐞 CVE-2026-33439: jato.clientSession डिसीरियलाइज़ेशन के ज़रिए OpenAM प्री-ऑथ RCE मानव अंतर्दृष्टि + AI-सहायता प्राप्त विश्लेषण + रिवर्स इंजीनियरिंग + एडवाइज़री → एक्सप्लॉइट CVE-2026-33439 के लिए पहला सार्वजनिक रूप से साझा किया गया एक्सप्लॉइट इम्प्लीमेंटेशन ForgeRock OpenAM में बिना प्रमाणीकरण वाल...

CVE-2026-33439-OpenAM

CVE-2026-33439 ist ein unsicheres Deserialisierungsproblem vor der Authentifizierung in OpenAM 16.0.6, das JATO-ViewBean-Endpunkte betrifft. Öffentliche Sicherheitshinweise erwähnen JATO-Endpunkte, listen jedoch keine erreichbaren Routen auf. Diese Forschung identifiziert...

CVE-2026-33439-PoC

CVE-2026-33439 — OpenAM Pre-Auth RCE Echo-Modus Befehlsausgabe direkt in der HTTP-Antwort — keine DNS-Exfiltration oder OOB erforderlich. Verwendet com.iplanet.jato.RequestManager.getRequestContext, um während der Deserialisierung auf die aktive JATO-ThreadLocal-Request/Response zuzugreifen...

OpenAM

Open Access Management OpenAM è una soluzione di gestione degli accessi che include autenticazione, SSO, autorizzazione, federazione, entitlement e Web Services Security. Cross Domain Single Sign On CDSSO, SAML 2.0, OAuth 2.0 e OpenID Connect garantiscono che OpenAM si integri facilmente con...

CVE-2021-29156

CVE-2021-29156 richtig gemacht Dieser Proof of Concept wurde umgesetzt, weil der andere öffentlich verfügbare PoC defekt ist ✨ Installation root@kitploit: go install github.com/5amu/CVE-2021-29156@latest Referenzen https://nvd.nist.gov/vuln/detail/CVE-2021-29156...

ForgeRock OpenAM <7.0 - Remote Code Execution

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/ request to the server. The vulnerabilit...

OpenAM Insecure SSO Cookie Initialization

Summary Description An Insecure Default Initialization of Resource CWE-1188 issue in the OpenAM default configuration ships the iPlanetDirectoryPro SSO cookie with HttpOnly=false. Also, the iPlanetDirectoryPro SSO cookie is used as a CSRF token in OAuth/OIDC flows. This affects OpenAM Community...

OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

Summary A pre-authentication remote code execution vulnerability affects OpenAM. The remote authentication endpoint /authservice, PLL accepts an XML element that names an arbitrary Java class, which the server then loads and instantiates without validation. On a default configuration this is...

GHSA-WG5R-WC3X-39VC OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

Summary A pre-authentication remote code execution vulnerability affects OpenAM. The remote authentication endpoint /authservice, PLL accepts an XML element that names an arbitrary Java class, which the server then loads and instantiates without validation. On a default configuration this is...

OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page

Description The OAuth2/OIDC consent page rendered for display=wap authorize requests reflected several request-derived values into the HTML response without escaping. An attacker who induces a user with an active OpenAM session to follow a crafted authorize link can execute arbitrary JavaScript i...

GHSA-VQXV-6XRH-49CP OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page

Description The OAuth2/OIDC consent page rendered for display=wap authorize requests reflected several request-derived values into the HTML response without escaping. An attacker who induces a user with an active OpenAM session to follow a crafted authorize link can execute arbitrary JavaScript i...

OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

Summary The GHSA-6c99-87fr-6q7r fix wrapped WebAuthn authenticator deserialization in an ObjectInputFilter meant to allow only AuthenticatorImpl, but it short-circuits to ALLOWED for any object at stream depth 1. Because the Java serialization filter is consulted for every class in the graph and...

GHSA-4V2W-2WQP-MC85 OpenAM OAuth Authorization Bypass via PKCE Challenge

Summary Description An Improper Authorization CWE-285 issue in OpenAM's OAuth2 authorization-code grant allows a PKCE-protected authorization code to be redeemed without the required codeverifier. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1. The...

GHSA-F2CX-463Q-7M2C OpenAM OAuth Client Impersonation via JWKS Resolver Cache

Summary Description An Improper Authentication CWE-287 issue in OpenAM's OAuth2 privatekeyjwt client authentication path allows any registered OAuth2 client to mint tokens in the name of any other client whose key is published via a jwksuri, without knowing the victim's signing key. This affects...

GHSA-69J4-QVQR-HPW3 OpenAM Authenticated RCE via Groovy Sandbox Escape

Summary Description A Protection Mechanism Failure CWE-693 in OpenAM's server-side scripting sandbox allows an authenticated script author execute operating-system commands from the OpenAM JVM with the default class allow and deny lists. This impacts OpenAM Community Edition through version 16.0....