
Vulnerable endpoint description for CVE-2026-33439 in OpenAM
CVE-2026-33439 is a pre-auth unsafe deserialization issue in OpenAM (<16.0.6) affecting JATO ViewBean endpoints. Public advisories mention JATO endpoints but do not enumerate reachable routes. This research identifies /openam/ui/PWResetUserValidation as a reachable pre-auth JATO endpoint.