Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM
Title source: cnaExploitation Summary
EIP tracks 4 public exploits for CVE-2026-33439. PoCs published by adminlove520, TheMalwareGuardian, Ibonok. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2026-33439, a pre-authentication RCE vulnerability in ForgeRock/OpenIdentityPlatform OpenAM. The exploit leverages deserialization of the `jato.clientSession` parameter via an Encoder.deserialize() call without class whitelist filtering, using a Click1 + External Xalan TemplatesImpl gadget chain to achieve command execution with output echoed directly in the HTTP response.
Description
Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464. An unauthenticated attacker can achieve arbitrary command execution on the server by sending a crafted serialized Java object as the jato.clientSession GET/POST parameter to any JATO ViewBean endpoint whose JSP contains <jato:form> tags (e.g., the Password Reset pages). This vulnerability is fixed in 16.0.6.
Exploits (4)
This repository contains a functional exploit for CVE-2026-33439, a pre-authentication RCE vulnerability in ForgeRock/OpenIdentityPlatform OpenAM. The exploit leverages deserialization of the `jato.clientSession` parameter via an Encoder.deserialize() call without class whitelist filtering, using a Click1 + External Xalan TemplatesImpl gadget chain to achieve command execution with output echoed directly in the HTTP response.
This repository contains a functional exploit for CVE-2026-33439, targeting OpenAM's pre-authentication RCE via deserialization of the jato.clientSession parameter. The exploit leverages a gadget chain involving PriorityQueue, Column$ColumnComparator, and TemplatesImpl to achieve remote code execution.
This repository contains a functional exploit for CVE-2026-33439, a pre-authentication RCE vulnerability in ForgeRock/OpenIdentityPlatform OpenAM. The exploit leverages deserialization of the `jato.clientSession` parameter via an Encoder.deserialize() call without class whitelist filtering, using a Click1 + External Xalan TemplatesImpl gadget chain to achieve remote code execution.
This repository provides a technical writeup identifying a pre-auth unsafe deserialization vulnerability in OpenAM's JATO ViewBean endpoints, specifically highlighting the reachable endpoint /openam/ui/PWResetUserValidation. It offers research insights but lacks functional exploit code.
Nuclei Templates (1)
http.title:"OpenAM"
title="OpenAM"
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H