CVE-2026-55414
Received Received - Intake

NL Portal Backend Libraries Unauthenticated SSRF via Objecten-API Token

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. From 1.1.0 until 3.0.4, and in 3.1.0, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL resolvers are reachable without CommonGroundAuthentication and forward a caller-influenced URL through ObjectenApiService.getObjectByUrl to ObjectsApiClient.getObjectByUrl, which attaches the privileged Objecten-API token. The host-equality check restricts requests to the configured Objecten-API host but does not constrain the scheme, port, or path, allowing an unauthenticated caller to induce a token-bearing request to a chosen endpoint on that host. Standard deployments are not exposed to cross-host SSRF, token capture requires attacker-controlled routing on the configured host, and typed deserialization limits returned data to objects shaped like form definitions. The 3.0 release line is fixed in version 3.0.4. The advisory does not identify a fixed 3.1 release.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-16
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-55414
EUVD
EUVD-2026-102226

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nl-portal nl-portal-backend-libraries >= 1.1.0, < 3.0.4
nl-portal nl-portal-backend-libraries = 3.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Same-Host Server-Side Request Forgery (SSRF) vulnerability in the NL Portal Backend Libraries. Unauthenticated attackers can exploit two GraphQL resolvers to send requests to a URL of their choice on the same host using a privileged Objecten-API token. The vulnerability exists because the resolvers do not require authentication and pass URLs without proper validation. The only check verifies the host but ignores scheme, port, or path, allowing token exposure if the attacker controls a different port or path on the same host.

Detection Guidance

Check for unauthorized GraphQL requests to /graphql endpoints using tools like curl or Wireshark. Look for requests to getFormDefinitionByObjectenApiUrl or getFormDefinitionById without authentication headers. Monitor logs for Objecten-API token usage from unexpected sources.

Impact Analysis

An attacker could induce the backend to send token-bearing requests to endpoints they control on the same host. This could lead to token exposure if the attacker has a listener on that host. However, cross-host SSRF is not possible in standard deployments, and arbitrary data exfiltration is limited by typed deserialization, which restricts responses to form definition objects.

Compliance Impact

The vulnerability could potentially expose sensitive data by allowing unauthenticated requests to fetch form definitions using a privileged API token. This may violate GDPR's data protection principles if personal data is involved, as unauthorized access could occur. HIPAA compliance could also be impacted if protected health information is exposed through the SSRF vulnerability.

Mitigation Strategies

Upgrade to version 3.0.4 or later immediately. Remove or restrict access to the vulnerable GraphQL resolvers. Ensure authentication is enforced for all GraphQL endpoints. Review and rotate Objecten-API tokens if they may have been exposed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55414. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart