CPE
OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the `jato.clientSession` HTTP parameter, allowing unauthenticated attackers to execute arbitrary commands on the server.