OpenAM versions prior to 16.1.4 allow administrators, including delegated realm administrators, to control federation configuration wizard metadata URLs so that the server fetches arbitrary URLs. This server-side request forgery can be used to probe internal hosts or cloud metadata services, returning partial responses that may reveal sensitive information about the internal network. The vulnerability does not give the ability to execute arbitrary code but permits internal network enumeration and limited disclosure of internal configuration data.

OpenIdentityPlatform’s OpenAM software versions earlier than 16.1.4 are affected.

The CVSS score of 5.1 indicates moderate severity. The exploit is only possible for users with administrative authority or delegated realm administration rights. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that public exploitation is not currently documented. However, an attacker who can gain an administrative role can use the vulnerability to access internal endpoints and gather useful information.