GHSA-7q42-6xr7-9rmw: OpenAM before 16.1.4 SSRF via UMA Scope Description URLs

Published Nov 8, 2026

Updated

OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows parties registering UMA resource sets to trigger internal requests through unvalidated scope description URLs. Attackers can register resource sets with scope URLs pointing to internal hosts or cloud metadata endpoints, which OpenAM fetches when sending pending-request notification emails, enabling internal network probing.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenAM to a version that resolves this vulnerability.
Fixed in 16.1.4

Event History

Nov 8, 2026

CVE Published

via OSV·01:37 AM

Data Sourced

via OSV·01:37 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Parties that can register UMA resource sets can supply scope description URLs that OpenAM later fetches. They can point those URLs at internal hosts or cloud metadata endpoints.

What application behavior triggers the server-side request?

OpenAM fetches the unvalidated scope description URL when it sends pending-request notification emails. A maliciously registered resource set can therefore cause requests from the OpenAM server to attacker-chosen internal destinations.

Which versions are affected?

OpenAM versions before 16.1.4 are affected.

GHSA-7q42-6xr7-9rmw: OpenAM before 16.1.4 SSRF via UMA Scope Description URLs

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What application behavior triggers the server-side request?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What application behavior triggers the server-side request?

Which versions are affected?