CVE-2026-123537: SSRF

Published Nov 8, 2026

Updated

OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows parties registering UMA resource sets to trigger internal requests through unvalidated scope description URLs. Attackers can register resource sets with scope URLs pointing to internal hosts or cloud metadata endpoints, which OpenAM fetches when sending pending-request notification emails, enabling internal network probing.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenAM to a version that resolves this vulnerability.
Fixed in 16.1.4

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

Parties that can register UMA resource sets can supply scope description URLs that OpenAM later fetches. The issue is therefore exposed where untrusted or insufficiently trusted users can create these resource sets.

When does OpenAM make the attacker-controlled request?

The request is triggered when OpenAM sends pending-request notification emails. A malicious scope description URL can cause OpenAM to fetch an internal host or cloud metadata endpoint at that time.

What can an attacker do with the SSRF condition?

The described impact is internal network probing through requests originating from the OpenAM server. URLs can target internal hosts or cloud metadata endpoints.

CVE-2026-123537: SSRF

Remediation

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

When does OpenAM make the attacker-controlled request?

What can an attacker do with the SSRF condition?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

When does OpenAM make the attacker-controlled request?

What can an attacker do with the SSRF condition?