GHSA-2cqq-rpvq-g5qj: OpenIdentityPlatform OpenAM: Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM

OpenIdentityPlatform OpenAM 16.0.5 has a critical vulnerability that allows unauthenticated attackers to run arbitrary commands on the server through unsafe deserialization (the process of converting stored data back into objects) of the `jato.clientSession` parameter. Although a previous fix blocked this attack on a similar parameter called `jato.pageSession`, the `jato.clientSession` parameter was overlooked and remains unprotected, enabling attackers to exploit it through password reset pages and similar endpoints.