Unsecured deserialization in the oauth2.php endpoint of OpenSTAManager permits an attacker to supply a crafted state parameter that is unserialized without verification, enabling arbitrary code execution on the server. The vulnerability can compromise confidentiality, integrity, and availability if successfully exploited. The flaw has a CVSS score of 7.2, classifying it as high severity. It reflects a common insecure deserialization weakness as indicated by CWE-502.

Any deployment of devcode‑it OpenSTAManager running a version earlier than 2.10.2 is impacted because the vulnerable code resides in that release. Organizations using earlier releases should verify the build number and vendor the software for updates.

Exploitation requires only an unauthenticated HTTP GET request to the oauth2.php script. The EPSS score is reported as less than 1% and the vulnerability is not yet listed in CISA’s KEV catalog, yet the potential for full remote compromise makes it a high priority. Affected systems exposed to external networks or with internal threat actors can be compromised without additional credentials. The attack path is straightforward and does not depend on complicated configuration or post‑exploitation steps.