Deserialization of untrusted data in Openidentityplatform Openam
CVSS score
9.8
EPSS probability
%8.4
Risk score
0.8
Published
6 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
Proof of concept for CVE-2026-33439, an unauthenticated RCE in OpenAM via Java deserialization
Python PoC for CVE-2026-33439, an OpenAM pre-authentication RCE via jato.clientSession deserialization
First publicly shared exploit implementation for CVE-2026-33439 (OpenAM pre-auth RCE via jato.clientSession deserialization).
Vulnerable endpoint description for CVE-2026-33439 in OpenAM
Nuclei: OpenAM <= 16.0.5 - Pre-Auth RCE via jato.clientSession Deserialization
https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-2cqq-rpvq-g5qj
Similar Vulnerabilities
OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback
OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI
OpenAM Authentication Bypass via MSISDN LDAP Injection
OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass
OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints
OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-33439"