CVE-2026-123552: SSRF

Published Nov 8, 2026

Updated

OpenAM before 16.1.4 contains a server-side request forgery vulnerability in certificate CRL checking that fetches CRLs from the distribution point named in a presented certificate without restricting the destination or verifying the downloaded CRL's signature. Attackers holding a trusted-CA-chained certificate can make OpenAM request internal hosts, capture configured CRL update credentials, overwrite stored revocation data to block certificate authentication for that CA, and tie up authentication threads.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenAM to a version that resolves this vulnerability.
Fixed in 16.1.4

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs a certificate that chains to a CA trusted by the affected OpenAM deployment. They can place a CRL distribution point in that certificate that causes OpenAM to fetch a chosen destination.

What are the practical impacts beyond server-side requests?

The attacker may capture configured CRL update credentials, replace stored revocation data to prevent certificate authentication for the affected CA, and consume authentication threads. These effects can enable credential exposure and denial of service.

What version should be used to remediate the issue?

The issue affects OpenAM versions before 16.1.4. Upgrade to 16.1.4 or later.

CVE-2026-123552: SSRF

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What are the practical impacts beyond server-side requests?

What version should be used to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What are the practical impacts beyond server-side requests?

What version should be used to remediate the issue?