9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33439

CVE-2026-33439: Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM

Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464. An unauthenticated attacker can achieve arbitrary command execution on the server by sending a crafted serialized Java object as the jato.clientSession GET/POST parameter to any JATO ViewBean endpoint whose JSP contains jato:form tags (e.g., the Password Reset pages). This vulnerability is fixed in 16.0.6.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33439

CVE-2026-33439:

9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.openidentityplatform.openam:openam	maven	<= 16.0.5	16.0.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a pre-authentication remote code execution flaw caused by unsafe Java deserialization. The root cause lies in the com.iplanet.jato.util.Encoder.deserialize method, which, prior to the patch, used ApplicationObjectInputStream to deserialize byte streams without any security checks like class whitelisting. The provided patch confirms this by replacing the vulnerable deserialization logic with a call to a new utility method, IOUtils.deserialise.

The vulnerability is triggered when the com.iplanet.jato.ClientSession.deserializeAttributes method is called. This method takes the value from the jato.clientSession HTTP parameter, which is read in the ClientSession constructor, and passes it to the vulnerable Encoder.deserialize method. An unauthenticated attacker can send a specially crafted serialized Java object in this parameter to an endpoint that uses a <jato:form> tag, which will trigger the deserialization and lead to arbitrary code execution on the server.

Vulnerable functions

com.iplanet.jato.util.Encoder.deserialize

jato-shaded/src/main/java/com/iplanet/jato/util/Encoder.java

This function was responsible for deserializing a byte stream using `ApplicationObjectInputStream`, which does not implement any class whitelisting, making it vulnerable to deserialization of untrusted data. The patch replaces this unsafe implementation with a call to `IOUtils.deserialise`, which is expected to perform safe deserialization.

com.iplanet.jato.ClientSession.deserializeAttributes

com/iplanet/jato/ClientSession.java

This function retrieves user-controlled data from the `jato.clientSession` HTTP parameter via the `encodedSessionString` field, decodes it, and passes it to the vulnerable `Encoder.deserialize` function. This is the entry point for the malicious payload.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.