OpenAM <= 16.0.5 - Pre-Auth RCE via jato.clientSession Deserialization
CVE-2026-33439
Verified
Description
Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464. This vulnerability is fixed in 16.0.6.
Severity
Critical
CVSS Score
9.8
Exploit Probability
8%
Affected Product
openam
Published Date
April 14, 2026
Template Author
dhiyaneshdk
CVE-2026-33439.yaml
9.8Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-33439
CWE ID:
cwe-502
Remediation Steps
Upgrade to OpenAM 16.0.6 or later.