GHSA-rmw3-j353-w9f7: OpenAM before 16.1.4 SSRF via Federation Configuration Wizard Metadata URLs

Published Nov 8, 2026

Updated

OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows administrators, including delegated realm administrators, to make the server fetch arbitrary URLs through federation configuration wizard metadata URLs. Attackers can enter metadata or OpenID Connect discovery URLs pointing to internal hosts or cloud metadata endpoints to probe the internal network and read partial responses.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenAM to a version that resolves this vulnerability.
Fixed in 16.1.4

Event History

Nov 8, 2026

CVE Published

via OSV·01:37 AM

Data Sourced

via OSV·01:37 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An OpenAM administrator can exploit it, including a delegated realm administrator. Exploitation requires access to the federation configuration wizard and the ability to supply metadata or OpenID Connect discovery URLs.

What systems or data could be exposed through exploitation?

The OpenAM server can be induced to fetch arbitrary URLs, allowing an attacker to probe internal hosts or cloud metadata endpoints. The issue can expose partial responses returned by those targets.

Are default installations affected?

The available information does not state whether the federation configuration wizard is enabled or accessible in a default installation. Exposure depends on whether an administrator or delegated realm administrator can use the relevant wizard URL fields.

What can be done before upgrading?

Restrict federation configuration wizard access to only fully trusted administrators and delegated realm administrators. Do not allow untrusted users to enter metadata or OpenID Connect discovery URLs, particularly URLs targeting internal networks or cloud metadata endpoints.

GHSA-rmw3-j353-w9f7: OpenAM before 16.1.4 SSRF via Federation Configuration Wizard Metadata URLs

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What systems or data could be exposed through exploitation?

Are default installations affected?

What can be done before upgrading?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What systems or data could be exposed through exploitation?

Are default installations affected?

What can be done before upgrading?