Description
Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464. An unauthenticated attacker can achieve arbitrary command execution on the server by sending a crafted serialized Java object as the jato.clientSession GET/POST parameter to any JATO ViewBean endpoint whose JSP contains <jato:form> tags (e.g., the Password Reset pages). This vulnerability is fixed in 16.0.6.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenIdentityPlatform | OpenAM | < 16.0.6 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 10 repositories
-
TheMalwareGuardian/CVE-2026-33439 ★ 12 · Apr 30, 2026
First publicly shared exploit implementation for CVE-2026-33439 (OpenAM pre-auth RCE via jato.clientSession deserialization).
-
infernosalex/CVE-2026-33439-Python-PoC ★ 6 · Sep 12, 2026
Python PoC for CVE-2026-33439, an OpenAM pre-authentication RCE via jato.clientSession deserialization
-
stapat1245/CVE-2026-33439_poc ★ 2 · Nov 2, 2026
Proof of Concept for CVE-2026-33439 RCE in OpenAM
-
Ibonok/CVE-2026-33439-PoC ★ 2 · Apr 28, 2026
CVE-2026-33439
-
rh33t/CVE-2026-33439-Poc ★ 1 · Sep 20, 2026
Proof of concept for CVE-2026-33439, an unauthenticated RCE in OpenAM via Java deserialization
-
duohnson/CVE-2026-33439-PoC ★ 0 · Nov 6, 2026
pre-authentication remote code execution vulnerability affecting OpenIdentityPlatform OpenAM in versions equal to or earlier than 16.0.5 and earlier
-
TeoVMP/CVE-2026-33439 ★ 0 · Oct 29, 2026
Pre-auth RCE exploit for OpenIdentityPlatform OpenAM <=16.0.5 via Java deserialization of the jato.clientSession parameter (CVE-2026-33439, CVSS 9.8). Comparator-based gadget chain with in-band comma…
-
amis13/openam-clean ★ 0 · Oct 7, 2026
CVE-2026-33439
-
JonasChen0103/CVE-2026-33439-PoC ★ 0 · Sep 19, 2026
CVE-2026-33439 OpenAM pre-auth RCE PoC
-
shreyas-malhotra/CVE-2026-33439-OpenAM ★ 0 · Apr 27, 2026
Vulnerable endpoint description for CVE-2026-33439 in OpenAM
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- OpenAM <= 16.0.5 - Pre-Auth RCE via jato.clientSession Deserialization http/cves/2026/CVE-2026-33439.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.openidentityplatform.openam:openam | < 16.0.6 | 16.0.6 | GHSA-2cqq-rpvq-g5qj |