Executive brief
OpenAM is an identity and access management solution used to secure web applications and manage user sessions. A critical security flaw allows an unauthenticated attacker to remotely execute commands on the server by sending a specially crafted web request. This could lead to a total system takeover, theft of sensitive user credentials, and unauthorized access to protected corporate resources.
Technical details
OpenIdentityPlatform OpenAM prior to version 16.0.6 is vulnerable to pre-authentication Remote Code Execution (RCE) due to unsafe Java deserialization (CWE-502). The vulnerability exists in the ClientSession.deserializeAttributes() method, which processes the 'jato.clientSession' HTTP parameter using ApplicationObjectInputStream without a class whitelist. This bypasses previous mitigations (CVE-2021-35464) that only addressed the 'jato.pageSession' parameter. An unauthenticated attacker can trigger the exploit by sending a crafted serialized Java object via GET or POST to any JATO ViewBean endpoint containing <jato:form> tags. Successful exploitation allows arbitrary OS command execution under the context of the application server user. The issue is resolved in version 16.0.6 by implementing WhitelistObjectInputStream filtering.
Affected products
- OpenIdentityPlatform OpenAM < 16.0.6
Timeline
- 2026-04-07: advisory: GitHub Security Advisory GHSA-2cqq-rpvq-g5qj published
- 2026-04-07: disclosed
- 2026-04-07: patched: Fixed in version 16.0.6