OpenAM: Critical Pre-Auth RCE, CVE-2026-33439

OpenAM, the OpenIdentityPlatform access management solution, is affected by CVE-2026-33439: an unsafe Java deserialization in the jato.clientSession HTTP parameter allows remote code execution without any authentication. The issue affects versions prior to 16.0.6 and involves JATO ViewBean endpoints whose JSP pages contain <jato:form> tags, typically including password reset pages.

Severity is rated critical, with a CVSS of 9.8. Notably, the flaw bypasses a specific mitigation (WhitelistObjectInputStream) introduced in response to CVE-2021-35464, showing that the protection applied to the jato.pageSession parameter did not also cover jato.clientSession. A public repository dated October 29, 2026 claims to contain a working exploit for this CVE; this is a signal of attention around the spread of technical information, not independent confirmation of active in-the-wild exploitation.

For defenders, the priority is immediate upgrade to OpenAM 16.0.6 or later, since this attack requires no credentials. Organizations should check which JATO ViewBean endpoints are publicly exposed, with particular attention to password reset pages, and set up detection controls on the jato.clientSession and jato.pageSession parameters in incoming HTTP requests, keeping logs available for retrospective analysis.