Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-46495— OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI

Quick assessment

Affected
OpenIdentityPlatform OpenDJ
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenDJ 是一个符合 LDAPv3 标准的目录服务。在版本 5.1.1 之前，位于 中的 JMX RMI 连接器在处理攻击者可控的凭据对象时，未实施严格的 过滤策略，且此操作发生在身份验证之前。此外， 中的 方法接受一个无约束的 数组，而非限定为两个元素的 。 当启用 JMX 连接处理器且其 TCP 监听器可被访问时，未认证的远程攻击者可以提交一个精心构造的序列化 Java 对象，从而在 OpenDJ 服务器进程中实现代码执行。 该处理器默认处于禁用状态，且成功利用此漏洞依赖于运行时类路径和 Java 版本。已

CVSS 9.2 · Critical EPSS 1.13% · P66

Affected Version Matrix 2

VendorProduct Version RangeStatus
OpenIdentityPlatform OpenDJ < 5.1.1 affected
org.openidentityplatform.opendj opendj-server-legacy < 5.1.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-46495

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI
Source: CVE Program / CVE List V5
Vulnerability Description
OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.1, the JMX RMI connector in opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/RmiConnector.java processes attacker-controlled credential objects before authentication without a restrictive jmx.remote.rmi.server.credentials.filter.pattern, and RmiAuthenticator.authenticate in opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/RmiAuthenticator.java accepts an unconstrained Object array rather than a two-element String[]. When the JMX Connection Handler is enabled and its TCP listener is reachable, an unauthenticated remote attacker can submit a crafted serialized Java object and achieve code execution in the OpenDJ server process. The handler is disabled by default, and successful exploitation depends on the runtime classpath and Java version; remote code execution was demonstrated against OpenDJ 4.4.15 on JDK 11 with Jackson 2.12.6.1. This issue is fixed in 5.1.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
OpenIdentityPlatform OpenDJ < 5.1.1 -
org.openidentityplatform.opendj opendj-server-legacy < 5.1.1 -

II. Public POCs for CVE-2026-46495

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-46495

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-46495 (3)

Vendor Advisories for CVE-2026-46495 (1)

Vendor Pages for CVE-2026-46495 (1)

Same Patch Batch · OpenIdentityPlatform · 2026-09-15 · 19 CVEs total

CVE-2026-62379 9.8 CRITICAL OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCust
CVE-2026-46619 9.3 CRITICAL OpenAM Authentication Bypass via MSISDN LDAP Injection
CVE-2026-45052 9.3 CRITICAL OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery
CVE-2026-45051 9.2 CRITICAL OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage
CVE-2026-62263 9.2 CRITICAL OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass
CVE-2026-48717 9.1 CRITICAL OpenAM OAuth Authorization Bypass via PKCE Challenge
CVE-2026-45048 8.5 HIGH OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC
CVE-2026-44203 8.3 HIGH OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state paramete
CVE-2026-45794 7.7 HIGH OpenAM Unsafe Java Deserialization via SNS
CVE-2026-47426 7.6 HIGH OpenAM OAuth Client Impersonation via JWKS Resolver Cache
CVE-2026-46498 7.6 HIGH OpenAM Arbitrary OAuth Token Minting via Push Registration
CVE-2026-47424 7.5 HIGH OpenAM Authenticated RCE via Groovy Sandbox Escape
CVE-2026-53660 7.4 HIGH OpenAM Insecure SSO Cookie Initialization
CVE-2026-46623 7.4 HIGH OpenAM Account Takeover via Unverified Password Change in OAuth2 Module
CVE-2026-41573 7.1 HIGH OpenAM LDAP Injection via `_queryId` Parameter
CVE-2026-44793 7.0 HIGH OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `F
CVE-2026-62280 6.1 MEDIUM OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page
CVE-2026-44202 5.3 MEDIUM OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`

IV. Related Vulnerabilities

Same product: OpenDJ
Same vendor: OpenIdentityPlatform
Same weakness: CWE-502