OpenAM Pre-Auth Deserialization RCE (CVE-2026-33439)

Exploits CVE-2026-33439 in OpenAM = 16.0.5: unsafe Java deserialization of jato.clientSession on password reset endpoints bypasses the WhitelistObjectInputStream mitigation applied to jato.pageSession. !/usr/bin/env python3 -- coding: utf-8 -- """OpenAM jato.clientSession deserialization RCE...