CVE-2026-123536
Received Received - Intake

Server-Side Request Forgery in OpenAM Before 16.1.4

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows administrators, including delegated realm administrators, to make the server fetch arbitrary URLs through federation configuration wizard metadata URLs. Attackers can enter metadata or OpenID Connect discovery URLs pointing to internal hosts or cloud metadata endpoints to probe the internal network and read partial responses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123536
EUVD
EUVD-2026-119421

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
forgerock openam to 16.1.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-123536 is a server-side request forgery (SSRF) vulnerability in OpenAM versions before 16.1.4. It allows administrators, including delegated ones, to make the server fetch arbitrary URLs through federation configuration metadata URLs. Attackers can enter internal or cloud metadata endpoints to probe internal networks and read partial responses.

Detection Guidance

To detect this SSRF vulnerability in OpenAM, monitor outbound HTTP/HTTPS requests originating from the OpenAM server, especially those made during federation configuration. Check server logs for unusual URLs in metadata or OpenID Connect discovery requests. Use network traffic analysis tools like tcpdump or Wireshark to capture and inspect requests to internal or unexpected external hosts.

Impact Analysis

This vulnerability allows attackers with administrative access to probe internal networks, access internal services, or read partial responses from internal hosts. It could expose sensitive network information or enable further attacks on internal systems.

Mitigation Strategies
  • Upgrade OpenAM to version 16.1.4 or later to apply the official fix that restricts URL fetching to http/https, blocks loopback/private addresses, and limits redirects.
  • Restrict federation configuration rights to only trusted administrators to reduce attack surface.
  • Implement network-level controls to block outbound requests from the OpenAM server to internal or sensitive external addresses.
  • Avoid using URLs for metadata; manually paste metadata documents instead to prevent SSRF via URL input.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123536. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...