---
id: CVE-2026-33439
title: Open Access Management (OpenAM) is an access management solution
summary: >-
  Open Access Management (OpenAM) is an access management solution. Prior to
  16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote
  Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession
  HTTP…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-502
vendor: openidentityplatform
product: openam
affected:
  - openam < 16.0.6
patched:
  - openam 16.0.6
published: '2026-04-07'
updated: '2026-07-24'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-33439'
references:
  - url: >-
      https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-2cqq-rpvq-g5qj
    label: security-advisories@github.com
tags:
  - nvd
  - exploit-available
epss: 0.08428
epssPercentile: 0.94811
ingestedAt: '2026-07-25T23:05:58.053Z'
exploits:
  github: 6
  githubRepos:
    - 'https://github.com/shreyas-malhotra/CVE-2026-33439-OpenAM'
    - 'https://github.com/Ibonok/CVE-2026-33439-PoC'
    - 'https://github.com/TheMalwareGuardian/CVE-2026-33439'
  nuclei:
    - CVE-2026-33439
  checkedAt: '2026-09-27T10:33:44.756Z'
exploitAvailable: true
---

## Overview

Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464. An unauthenticated attacker can achieve arbitrary command execution on the server by sending a crafted serialized Java object as the jato.clientSession GET/POST parameter to any JATO ViewBean endpoint whose JSP contains <jato:form> tags (e.g., the Password Reset pages). This vulnerability is fixed in 16.0.6.

## Affected

- `openam < 16.0.6`

## Remediation

Upgrade past the affected range:

- `openam 16.0.6`