internet-facing-service-vulnerabilityidentity-authentication-vulnerabilityproof-of-concept-release

Pre-authentication RCE flaws exposed in ForgeRock and OpenAM deserialization paths

Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Apr 7, 2026

Researchers disclosed critical pre-authentication remote code execution flaws in ForgeRock/OpenAM that let attackers execute code without logging in by abusing unsafe Java deserialization in request parameters. PortSwigger reported CVE-2021-35464 in ForgeRock OpenAM, while later research detailed CVE-2026-33439 in OpenIdentityPlatform OpenAM, where attacker-controlled data in the jato.clientSession parameter could reach ApplicationObjectInputStream.readObject() without class filtering.

The newer flaw affected unauthenticated password-reset endpoints including /openam/ui/PWResetUserValidation and /openam/ui/PWResetQuestion, where JSP processing of <jato:form> tags exposed the vulnerable code path. Researchers said a crafted gadget chain could achieve code execution with a single GET request on OpenAM 16.0.5, and that version 16.0.6 fixed the issue by routing Encoder.deserialize() through the same whitelist-based deserialization protections previously applied to jato.pageSession; the bug was assigned CVSS 9.8 and mapped to CWE-502.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Jun 29, 2021 – Apr 7, 2026

Apr 7, 20267mo ago
OpenAM 16.0.6 fixes CVE-2026-33439 deserialization flaw
The disclosure states that OpenAM 16.0.6 fixes CVE-2026-33439 by routing Encoder.deserialize() through the same whitelist-based deserialization logic already used for jato.pageSession.
Pre-Auth RCE in OpenAM via jato.clientSession (CVE-2026-33439) | Hacktron AI
Apr 7, 20267mo ago
Hacktron discloses CVE-2026-33439 in OpenIdentityPlatform OpenAM
Hacktron disclosed CVE-2026-33439, a critical pre-authentication RCE in OpenIdentityPlatform OpenAM caused by unsafe deserialization of the jato.clientSession parameter on unauthenticated password reset pages. The write-up states the issue was tested on OpenAM 16.0.5 and can be exploited with a single GET request.
Pre-Auth RCE in OpenAM via jato.clientSession (CVE-2026-33439) | Hacktron AI
Jun 29, 20215y ago
PortSwigger discloses pre-auth RCE in ForgeRock OpenAM
PortSwigger Research published details of a pre-authentication remote code execution vulnerability in ForgeRock OpenAM tracked as CVE-2021-35464.
Pre-auth RCE in ForgeRock OpenAM (CVE-2021-35464)

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Pre-authentication Java deserialization RCE in OpenIdentityPlatform OpenAM (CVE-2026-33439)

Affected products

1 linked

Openam

Organizations

1 linked

Open Identity Platform

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Hacktron BlogNews · Apr 7, 2026

Pre-Auth RCE in OpenAM via jato.clientSession (CVE-2026-33439) | Hacktron AIOpen source ↗

Portswigger ResearchNews · Jun 29, 2021

Pre-auth RCE in ForgeRock OpenAM (CVE-2021-35464)Open source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Pre-authentication RCE flaws exposed in ForgeRock and OpenAM deserialization paths

How this story unfolded

OpenAM 16.0.6 fixes CVE-2026-33439 deserialization flaw

Hacktron discloses CVE-2026-33439 in OpenIdentityPlatform OpenAM

PortSwigger discloses pre-auth RCE in ForgeRock OpenAM

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

ForgeRock Misconfigurations at Two Automakers Enabled Account Takeover and Remote Car Control

Pre-auth RCE chains exposed in Bonita BPM and Apache OFBiz

Critical JWT Forgery and Pre-Auth SYSTEM RCE Disclosed in CIRCUTOR PowerStudio

Pre-authentication RCE flaws exposed in ForgeRock and OpenAM deserialization paths

How this story unfolded

OpenAM 16.0.6 fixes CVE-2026-33439 deserialization flaw

Hacktron discloses CVE-2026-33439 in OpenIdentityPlatform OpenAM

PortSwigger discloses pre-auth RCE in ForgeRock OpenAM

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

ForgeRock Misconfigurations at Two Automakers Enabled Account Takeover and Remote Car Control

Pre-auth RCE chains exposed in Bonita BPM and Apache OFBiz

Critical JWT Forgery and Pre-Auth SYSTEM RCE Disclosed in CIRCUTOR PowerStudio