OpenIdentityPlatform OpenAM before version 16.0.6 is vulnerable to a pre-authentication remote code execution vulnerability due to unsafe deserialization of the jato.clientSession HTTP parameter. This vulnerability bypasses the WhitelistObjectInputStream mitigation previously applied to the jato.pageSession parameter after CVE-2021-35464. An unauthenticated attacker can exploit this by sending a malicious serialized Java object to any JATO ViewBean endpoint with <jato:form> tags, enabling arbitrary command execution on the server. The issue is resolved in OpenAM 16.0.6.

Successful exploitation allows unauthenticated attackers to execute arbitrary code on the server hosting OpenAM, leading to full compromise of the affected system. This can result in unauthorized access, data theft, service disruption, or further network compromise. The vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

This vulnerability is fixed in OpenAM version 16.0.6. Users should upgrade to version 16.0.6 or later to remediate this issue. No official patch or temporary workaround is provided in the advisory data. Until upgrading, restrict access to vulnerable endpoints if possible and monitor for suspicious activity. Patch status is not yet confirmed beyond the fixed version statement; check the vendor advisory for current remediation guidance.