PT-2026-30917 · Forgerock · Openam+1

Iamnoooob · CVE-2026-33439 · Published 2026-04-07 · Updated 2026-06-24

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.0.6

Description Open Access Management (OpenAM) is an access management solution. An unauthenticated attacker can achieve arbitrary command execution on the server through unsafe Java deserialization. This occurs when a crafted serialized Java object is sent as the jato.clientSession GET/POST parameter to any JATO ViewBean endpoint whose JSP contains <jato:form> tags, such as Password Reset pages. This issue bypasses the WhitelistObjectInputStream mitigation previously applied to the jato.pageSession parameter.

Recommendations Update to version 16.0.6.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-33439

GHSA-2CQQ-RPVQ-G5QJ

Affected Products

Openam

Openidentityplatform

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33439.json · Exploit
• https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-2cqq-rpvq-g5qj · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2cqq-rpvq-g5qj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33439 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33439 · Security Note
• https://github.com/OpenIdentityPlatform/OpenAM · Note
• https://github.com/OpenIdentityPlatform/OpenAM/commit/014007c63cacc834cc795a89fac0e611aebc4a32 · Note
• https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.0.6 · Note
• https://twitter.com/lyrie_ai/status/2054427636647198878 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2045061150744744280 · Twitter Post
• https://twitter.com/pulsepatchio/status/2042073355642425601 · Twitter Post
• https://twitter.com/CVEnew/status/2041711876435013893 · Twitter Post
• https://twitter.com/0dayPublishing/status/2041624427666743722 · Twitter Post
• https://twitter.com/q810034/status/2043194198929904106 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/2045094962556272856 · Twitter Post