Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.2
CVE-2026-44202: OpenAM lets logged-in users trigger external requests
CVE-2026-44202 · published 4 months ago
Summary
The OpenAM identity platform’s session management endpoint accepts URLs from authenticated users without proper checks. An attacker who is already logged in can cause the server to contact any address they choose, potentially leaking session information. Apply the vendor’s update or restrict the endpoint to trusted URLs to stop this behavior.
What to do
- Update openidentityplatform org.openidentityplatform.openam:openam-core to version 16.1.1.
- Update org.openidentityplatform.openam:openam-core to version 16.1.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | openidentityplatform | openam | < 16.1.1 |
| maven | openidentityplatform | org.openidentityplatform.openam:openam-core |
<= 16.0.6 Fix: upgrade to 16.1.1
|
| Maven | openidentityplatform | org.openidentityplatform.openam:openam-core |
< 16.1.1 Fix: upgrade to 16.1.1
|
| Ubuntu:16.04:LTS | canonical | openam | All versions |
| maven | – | org.openidentityplatform.openam:openam-core |
<= 16.0.6 Fix: upgrade to 16.1.1
|
| Maven | – | org.openidentityplatform.openam:openam-core |
< 16.1.1 Fix: upgrade to 16.1.1
|
Original advisory text
OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`
OpenAM (Open Identity Platform) is an open-source Identity and Access Management (IAM) platform derived from ForgeRock OpenAM, providing SSO, OAuth2, SAML, and OpenID Connect capabilities. It is widely deployed in enterprise environments as a central authentication gateway.
The `/sessionservice` endpoint, used for internal session management operations, does not sufficiently restrict the URLs that authenticated users may register for session event notifications. Under certain conditions, this may result in outbound server-side requests to attacker-controlled destinations, potentially exposing session-related data.
This behavior results in a **server-side request forgery (SSRF)** vulnerability, where an authenticated attacker can trigger outbound requests to arbitrary destinations.
## Credit
Discovered by **JD-Security SHENYI Team**
The `/sessionservice` endpoint, used for internal session management operations, does not sufficiently restrict the URLs that authenticated users may register for session event notifications. Under certain conditions, this may result in outbound server-side requests to attacker-controlled destinations, potentially exposing session-related data.
This behavior results in a **server-side request forgery (SSRF)** vulnerability, where an authenticated attacker can trigger outbound requests to arbitrary destinations.
## Credit
Discovered by **JD-Security SHENYI Team**
References
- https://github.com/advisories/GHSA-c556-q2mh-477v
- https://github.com/OpenIdentityPlatform/OpenAM Product
- https://nvd.nist.gov/vuln/detail/CVE-2026-44202
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44202... Vendor Advisory
- https://github.com/OpenIdentityPlatform/OpenAM/commit/a13a4b63ae0e0670c63cbcfa79...
- https://ubuntu.com/security/CVE-2026-44202 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-44202 Third Party Advisory
- https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-c556-q2m...
- https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published22 Jun 2026
Updated4 Nov 2026
First seen22 Jun 2026
Sources
GHSA-c556-q2mh-477v · GHSA
CVE-2026-44202 · NVD
GHSA-c556-q2mh-477v · OSV
CVE-2026-44202 · MITRE
CVE-2026-44202 · OSV
UBUNTU-CVE-2026-44202 · OSV
Track software like this
Free during beta