Exploit for Deserialization of Untrusted Data in Openidentityplatform Openam

## https://sploitus.com/exploit?id=B2C95D2F-FF4C-5818-8899-798371B683D2
# CVE-2026-33439 Python PoC

Standalone Python proof of concept for the OpenAM pre-authentication remote code execution vulnerability in `jato.clientSession` deserialization.

The embedded shaded Click/Xalan gadget reads a shell command from the `cmd` HTTP header and returns its output in the HTTP response. No external Python packages, Java runtime, or JAR files are required.

## Usage

```bash
python3 exploit.py \
  --url https://target.example/openam/ui/PWResetUserValidation \
  'id'
```

Optional arguments:

```text
--timeout SECONDS     Request timeout (default: 15)
--proxy URL           HTTP proxy, for example http://127.0.0.1:8080
--verify-tls          Enable TLS certificate verification
```

## References

- [OpenAM security advisory GHSA-2cqq-rpvq-g5qj](https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-2cqq-rpvq-g5qj)
- [CVE-2026-33439](https://nvd.nist.gov/vuln/detail/CVE-2026-33439)

Use only against systems you own or are explicitly authorized to test.