CVE-2026-44202
Received Received - Intake

OpenAM Session Listener Arbitrary Notification URL Exposure

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the /sessionservice addSessionListener operation allows an authenticated user to register an arbitrary notification URL without requiring an administrative or application client token. SessionRequestHandler passes the attacker-controlled destination to the session listener service, causing the OpenAM server to make outbound requests and potentially disclose session-related notification data to an attacker-controlled destination. This issue is fixed in version 16.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-44202
EUVD
EUVD-2026-78355

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
forgerock openam 16.1.1
openidentityplatform openam to 16.1.1 (exc)
openidentityplatform openam to 16.0.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in OpenAM allows an authenticated user to register an arbitrary notification URL without proper authorization. The /sessionservice addSessionListener operation sends session-related data to this URL, potentially exposing sensitive information to an attacker-controlled destination.

Detection Guidance

To detect this vulnerability, check OpenAM server logs for unusual outbound requests from the /sessionservice endpoint. Monitor for unauthorized session listener registrations by reviewing access logs for addSessionListener operations without valid admin or application tokens. Verify if your OpenAM version is below 16.1.1.

Impact Analysis

An attacker with valid credentials could exploit this to make the OpenAM server send session data to unintended locations. This may lead to data leaks, unauthorized access to session information, or further attacks leveraging exposed data.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive session data, violating GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information. Compliance may be compromised if session data is exposed.

Mitigation Strategies

Upgrade OpenAM to version 16.1.1 or later immediately. If upgrading is not possible, restrict access to the /sessionservice endpoint and disable session listener registration for non-admin users. Review and remove any unauthorized session listeners already registered.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44202. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart