Vulnerabilities

TI-2026-25836 CVE-2026-33439 · GHSA-2cqq-rpvq-g5qj

Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM

MEDIUM 60

Open Access Management (OpenAM) is an access management solution.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.09333 Published 2026-04-07 Fixed in 16.0.6 CWE-502

TI-2023-19079 CVE-2023-37471 · GHSA-4mh8-9wq6-rjxg

User impersonation using SAMLv1.x SSO in Open Access Management

MEDIUM 51

Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0126 Published 2023-07-20 Fixed in 14.7.3 CWE-287

TI-2022-15210 CVE-2022-34298 · GHSA-px3r-27qc-hx5g

The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack."

LOW 30

The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack."

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03199 Published 2022-06-22 Fixed in 14.6.6 CWE-863

Vulnerabilities

Filters

Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM

User impersonation using SAMLv1.x SSO in Open Access Management

The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack."