MEDIUM 5.1 NVD
CVE-2026-123536
OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows administrators, including delegated realm administrators, to make the serv
OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows administrators, including delegated realm administrators, to make the server fetch arbitrary URLs through federation configuration wizard metadata URLs. Attackers can enter metadata or OpenID Connect discovery URLs pointing to internal hosts or cloud metadata endpoints to probe the internal network and read partial responses.
References
- https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-rmw3-j353-w9f7
- https://www.vulncheck.com/advisories/openam-before-16.1.4-ssrf-via-federation-configuratio
This medium severity vulnerability with a CVSS score of 5.1 was published on 2026-11-08 via NVD.
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.