Threats affecting pkg:maven/org.forgerock/openam

OpenIdentityPlatform OpenAM versions prior to 16.0.6 contain a critical deserialization vulnerability (CWE-502) that allows unauthenticated remote code execution. The flaw arises from unsafe Java deserialization of the jato.clientSession HTTP parameter, bypassing previous mitigations applied to a similar parameter. An attacker can exploit this by sending a crafted serialized Java object to specific endpoints using JATO ViewBean JSPs, such as password reset pages. This vulnerability is fixed in version 16.0.6.