Description
OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows parties registering UMA resource sets to trigger internal requests through unvalidated scope description URLs. Attackers can register resource sets with scope URLs pointing to internal hosts or cloud metadata endpoints, which OpenAM fetches when sending pending-request notification emails, enabling internal network probing.
Published: 2026-11-08
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Internal Network Exposure via SSRF
Action: Patch
AI Analysis

Impact

OpenAM before version 16.1.4 suffers a server‑side request forgery flaw that allows an attacker to register a Universal Access (UMA) resource set with a scope description URL pointing to an internal host or cloud metadata service. When OpenAM sends notifications for pending requests, it fetches the URL, thereby executing an internal request. The result is a covert probing capability that can discover internal services, potentially exposing sensitive endpoints.

Affected Systems

The vulnerability affects OpenIdentityPlatform’s OpenAM product, specifically all releases earlier than 16.1.4. Users running these older versions are impacted until they upgrade to a patched release.

Risk and Exploitability

The flaw scores a CVSS 5.3, indicating moderate impact. EPSS data is unavailable, and the issue is not listed in the CISA KEV catalog. Exploitation requires the ability to register UMA resource sets, and the internal request can be triggered by any registered set. The vulnerability enables internal network probing but does not grant direct code execution or external network reach.

Generated by OpenCVE AI on November 8, 2026 at 03:13 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to OpenAM 16.1.4 or later to remove the SSRF flaw.
  • If upgrading is not immediately possible, restrict UMA resource set registration and enforce access controls on the registration endpoint.
  • Implement URL validation to reject internal host or metadata URLs before processing, or block private IP ranges in the request handling logic.

Generated by OpenCVE AI on November 8, 2026 at 03:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 08 Nov 2026 01:45:00 +0000

Type Values Removed Values Added
Description OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows parties registering UMA resource sets to trigger internal requests through unvalidated scope description URLs. Attackers can register resource sets with scope URLs pointing to internal hosts or cloud metadata endpoints, which OpenAM fetches when sending pending-request notification emails, enabling internal network probing.
Title OpenAM before 16.1.4 SSRF via UMA Scope Description URLs
First Time appeared Openidentityplatform
Openidentityplatform openam
Weaknesses CWE-918
CPEs cpe:2.3:a:openidentityplatform:openam:*:*:*:*:*:*:*:*
Vendors & Products Openidentityplatform
Openidentityplatform openam
References
Metrics cvssV3_1

{'score': 5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N'}

Subscriptions

Openidentityplatform Openam
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-08T01:37:44.525Z

Reserved: 2026-11-06T00:48:46.279Z

Link: CVE-2026-123537

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-08T02:16:44.307

Modified: 2026-11-08T02:16:44.307

Link: CVE-2026-123537

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-08T03:15:08Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)