CVE-2026-33439: OpenAM RCE Vulnerability

CVE-2026-33439 Overview

CVE-2026-33439 is a critical pre-authentication Remote Code Execution (RCE) vulnerability affecting OpenIdentityPlatform OpenAM, an open-source access management solution. The vulnerability exists due to unsafe Java deserialization of the jato.clientSession HTTP parameter, allowing unauthenticated attackers to execute arbitrary commands on the server. This vulnerability notably bypasses the WhitelistObjectInputStream mitigation that was previously applied to the jato.pageSession parameter after CVE-2021-35464, representing a dangerous regression in the application's security posture.

Critical Impact

Unauthenticated attackers can achieve full remote code execution on OpenAM servers by sending crafted serialized Java objects, potentially leading to complete system compromise without requiring any credentials.

Affected Products

• OpenIdentityPlatform OpenAM versions prior to 16.0.6
• JATO ViewBean endpoints with JSPs containing <jato:form> tags
• Password Reset pages and similar form-based endpoints

Discovery Timeline

• 2026-04-07 - CVE-2026-33439 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-33439

Vulnerability Analysis

This vulnerability falls under CWE-502 (Deserialization of Untrusted Data), a well-known class of security flaws that can lead to severe consequences including remote code execution. The vulnerability is particularly dangerous because it occurs at the pre-authentication stage, meaning attackers do not need any valid credentials to exploit it.

The flaw exists in how OpenAM processes the jato.clientSession HTTP parameter. While the developers previously implemented protections for the similar jato.pageSession parameter following CVE-2021-35464, the jato.clientSession parameter was left unprotected, creating an exploitable attack surface. This oversight allows attackers to submit malicious serialized Java objects that are deserialized without proper validation.

Root Cause

The root cause is the absence of deserialization safeguards on the jato.clientSession parameter. When OpenAM processes incoming HTTP requests to JATO ViewBean endpoints, it deserializes the jato.clientSession parameter value directly without applying the WhitelistObjectInputStream protection that filters dangerous classes. This allows attackers to include malicious gadget chains in the serialized data that execute arbitrary code upon deserialization.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying a JATO ViewBean endpoint whose JSP contains <jato:form> tags (such as Password Reset pages)
2. Crafting a malicious serialized Java object containing a gadget chain (commonly using tools like ysoserial)
3. Sending the serialized payload as either a GET or POST parameter named jato.clientSession
4. Upon receipt, the server deserializes the object, triggering the embedded gadget chain and executing arbitrary commands

The exploitation does not require any authentication, making it accessible to any attacker who can reach the OpenAM server over the network. Common targets include the Password Reset functionality which inherently must be accessible to unauthenticated users.

Detection Methods for CVE-2026-33439

Indicators of Compromise

• Unusual HTTP requests to JATO ViewBean endpoints containing Base64-encoded or binary data in the jato.clientSession parameter
• Unexpected process spawning or command execution originating from the Java/OpenAM process
• Network connections to unknown external hosts initiated by the application server
• Presence of web shells or unauthorized files in the application directory

Detection Strategies

• Deploy web application firewall (WAF) rules to inspect and block suspicious serialized Java objects in HTTP parameters
• Monitor for known Java deserialization gadget chain signatures in HTTP traffic (e.g., ysoserial payloads)
• Implement application-level logging to capture and alert on jato.clientSession parameter usage
• Utilize endpoint detection and response (EDR) solutions to detect anomalous process behavior from Java applications

Monitoring Recommendations

• Enable detailed access logging on OpenAM servers and forward logs to a SIEM for analysis
• Set up alerts for POST requests containing binary or unusually long parameter values to form-based endpoints
• Monitor system integrity on OpenAM servers to detect unauthorized file modifications
• Implement network segmentation monitoring to detect unexpected outbound connections from application servers

How to Mitigate CVE-2026-33439

Immediate Actions Required

• Upgrade OpenIdentityPlatform OpenAM to version 16.0.6 or later immediately
• If immediate patching is not possible, restrict network access to OpenAM administrative and form-based endpoints
• Implement WAF rules to block or sanitize the jato.clientSession parameter
• Review server logs for any signs of exploitation attempts

Patch Information

The vulnerability is fixed in OpenAM version 16.0.6. Organizations should upgrade to this version or later as the primary remediation measure. The patch extends the WhitelistObjectInputStream deserialization protections to cover the jato.clientSession parameter, preventing malicious object deserialization.

For detailed information about the security fix, refer to the GitHub Security Advisory.

Workarounds

• Deploy a reverse proxy or WAF to filter requests containing the jato.clientSession parameter
• Temporarily disable or restrict access to endpoints with <jato:form> JSP tags if they are not business-critical
• Implement network-level access controls to limit which systems can reach OpenAM endpoints
• Consider deploying Java agent-based runtime application self-protection (RASP) solutions to block deserialization attacks

# Example: Block jato.clientSession parameter using ModSecurity WAF rule
SecRule ARGS:jato.clientSession "@rx .*" \
    "id:100001,phase:2,deny,status:403,msg:'Blocked potential OpenAM deserialization attack via jato.clientSession'"