---
id: 7642
title: "Pre-Auth RCE in OpenAM via jato.clientSession (CVE-2026-33439)"
source_domain: hacktron.ai
source_url: "https://www.hacktron.ai/blog/openam-deserialization-pre-auth-rce"
published_at: "2026-04-07T00:00:00Z"
tags: ["ai-security", "rce", "vulnerability-research", "java", "deserialization", "pre-auth-rce", "openam", "cve-2026-33439"]
phying_url: "https://phying.com/item/7642"
lang: en
---

# Pre-Auth RCE in OpenAM via jato.clientSession (CVE-2026-33439)

## Summary

Hacktron AI discovers a critical pre-authentication RCE in OpenAM through a forgotten deserialization parameter that the original CVE-2021-35464 fix missed.

## Intelligence Metadata

- **Sources:** hacktron.ai
- **Published:** 2026-04-07T00:00:00Z
- **Original:** https://www.hacktron.ai/blog/openam-deserialization-pre-auth-rce
- **Phying News:** https://phying.com/item/7642