Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Pre-Auth RCE in OpenAM via jato.clientSession (CVE-2026-33439)

hacktron.ai | vulnerability | #ai-security | #rce | #vulnerability-research | #java | #deserialization | #pre-auth-rce | #openam | #cve-2026-33439

Summary

Hacktron AI discovers a critical pre-authentication RCE in OpenAM through a forgotten deserialization parameter that the original CVE-2021-35464 fix missed.
Published
Collected

original ↗

Related coverage

research · idnsec.com
Mitigating RCE Impact Like in OpenAI Hack with Defense-in-Depth
Using HacktronAI's OpenAI Discourse hack disclosure, this article covers sandboxing, runtime protection, and AI-assisted defense to shrink the blast radius of RCE across interconnected apps.
vulnerability · portswigger.net
Pre-auth RCE in ForgeRock OpenAM (CVE-2021-35464)
A pre-auth RCE in ForgeRock OpenAM via unsafe deserialization in its Jato framework: the jato.pageSession parameter accepted Java objects exploitable with a custom ysoserial chain (CVE-2021-35464).
vulnerability · bishopfox.com
Master Key Included: Detecting SolarWinds ARM CVE-2026-28326
CVE-2026-28326 is an unauthenticated RCE in SolarWinds ARM where a hardcoded shared secret on TCP 55555 leads to SYSTEM-level code execution. Patch now.
vulnerability · idnsec.com
[CVE-2026-93485] Comment2XSS: Zero-Click Pre-Auth XSS to Potential RCE in WordPress Core
An unauthenticated stored XSS (CVE-2026-93485) in WordPress core's wpautop() turns crafted comments into zero-click XSS, escalating to RCE via the admin session. Fixed in 7.1.1, backported to 4.7.36.
Critical · vulnerability · github.com
Log4j FilteredObjectInputStream Bypass: Pre-auth RCE via MarshalledObject
This PoC demonstrates an unexpected filter-bypass gadget in Log4j 2, emphasizing the danger of unauthenticated serialized object ingestion.
vulnerability · blog.viettelcybersecurity.com
[CVE-2013-2165] When EL Injection meets Java Deserialization
Exploit development for RichFaces 4 CVE-2018-12532, chaining EL injection into Java deserialization and bypassing library restrictions to achieve reliable RCE on JSF applications.
back