CVE-2026-33439: Critical Pre-Auth RCE in OpenAM Before 16.0.6

CVE-2026-33439 is a critical (CVSS 9.8) pre-authentication remote code execution flaw in OpenIdentityPlatform OpenAM. The jato.clientSession parameter is deserialized unsafely, which bypasses an earlier fix for the same class of bug. OpenAM 16.0.5 and below are affected, and the fix is version 16.0.6.

What's affected

• Product: OpenIdentityPlatform OpenAM (org.openidentityplatform.openam:openam-core).
• Affected: 16.0.5 and below. The advisory says earlier versions are likely affected too.
• Fixed: 16.0.6.
• Exposed endpoints are JATO ViewBean pages whose JSP contains jato:form tags, such as the Password Reset pages.

How to check if you're exposed

Check the OpenAM version you run. For a Maven project, look at the dependency tree:

mvn dependency:tree | grep openam

For a deployed server, check the version shown in the admin console or the deployed WAR name, and confirm it is 16.0.6 or later. Also check whether the Password Reset or other JATO pages are reachable from untrusted networks.

Paste a lockfile or manifest into the free in-browser dependency scan to see whether OpenAM is in your tree. The Gold directory tracks this CVE, and reachability analysis helps you rank it against everything else you have open.

What to do now

1. Upgrade every OpenAM deployment to 16.0.6 or later.
2. If you cannot upgrade today, restrict network access to the OpenAM endpoints, especially the Password Reset pages. The advisory names no workaround, so this is only a way to reduce exposure.
3. Review web server and application logs for unusually large or odd values in the jato.clientSession parameter.
4. Rotate secrets held by the OpenAM host if you suspect compromise.
5. Consider a JVM wide deserialization filter as defense in depth, as the advisory suggests.

Why it matters

OpenAM accepts a serialized Java object in the jato.clientSession parameter and deserializes it without checking which classes are allowed. This is CWE-502, deserialization of untrusted data. After CVE-2021-35464, the project added a whitelist for the jato.pageSession parameter. This sibling parameter did not get the same protection, so the old attack path returned through a different door.

The advisory does not report exploitation in the wild, and the CVE is not in the CISA KEV catalog. An access management server sits in front of many other systems, so a pre-auth flaw there deserves a fast upgrade.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-2cqq-rpvq-g5qj
• https://nvd.nist.gov/vuln/detail/CVE-2026-33439

Last reviewed: 19 October 2026.