GitHub Advisoryadvisory · Maven

GHSA-c556-q2mh-477v OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`

MEDIUM Published 2026-06-22 Modified 2026-10-28 Official page ↗
Aliases
CVE-2026-44202
Ecosystem
Maven
Packages
org.openidentityplatform.openam:openam-core
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-918
Reviewed
2026-06-22

Affected packages

• Maven org.openidentityplatform.openam:openam-core: < 16.1.1 → fixed in 16.1.1

Description

OpenAM (Open Identity Platform) is an open-source Identity and Access Management (IAM) platform derived from ForgeRock OpenAM, providing SSO, OAuth2, SAML, and OpenID Connect capabilities. It is widely deployed in enterprise environments as a central authentication gateway. The `/sessionservice` endpoint, used for internal session management operations, does not sufficiently restrict the URLs that authenticated users may register for session event notifications. Under certain conditions, this may result in outbound server-side requests to attacker-controlled destinations, potentially exposing session-related data. This behavior results in a server-side request forgery (SSRF) vulnerability, where an authenticated attacker can trigger outbound requests to arbitrary destinations. Credit Discovered by JD-Security SHENYI Team

Related

Alias · CVE (1)

  • CVE-2026-44202 Open Access Management (OpenAM) is an access management solution. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References