The vulnerability is an unsafe Java deserialization flaw that allows a pre‑authentication attacker to inject a malicious serialized object into the jato.clientSession HTTP parameter. This bypasses a mitigation that was applied to jato.pageSession after a previous CVE, giving the attacker the ability to execute arbitrary system commands on the server. The flaw essentially turns the target system into an untrusted endpoint that can run any code supplied by the attacker.

OpenIdentityPlatform OpenAM versions prior to 16.0.6 are affected. Any JATO ViewBean endpoint whose JSP contains <jato:form> tags, such as Password Reset pages, is vulnerable. The flaw exists in the handling of the jato.clientSession parameter in those endpoints.

The CVSS score of 9.3 indicates a critical severity. The EPSS score of 8% indicates a moderate exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is sending a crafted serialized Java object as the jato.clientSession GET/POST parameter to any vulnerable endpoint, achieving remote code execution without authentication.