{"id":"CVE-2026-123536","title":"OpenAM before 16.1.4 SSRF via Federation Configuration Wizard Metadata URLs","summary":"OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows administrators, including delegated realm administrators, to make the server fetch arbitrary URLs through federation configuration wizard metadata URLs…","severity":"medium","cvss":4.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-918"],"vendor":"OpenIdentityPlatform","product":"OpenAM","affected":["OpenAM < 16.1.4"],"published":"2026-11-08","updated":"2026-11-08","sourceUpdated":"2026-11-08T01:37:43.836Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-123536","references":[{"url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-rmw3-j353-w9f7","label":"GitHub Security Advisory (GHSA-rmw3-j353-w9f7)"},{"url":"https://www.vulncheck.com/advisories/openam-before-16.1.4-ssrf-via-federation-configuration-wizard-metadata-urls","label":"VulnCheck Advisory: OpenAM before 16.1.4 SSRF via Federation Configuration Wizard Metadata URLs"}],"tags":["cve.org"],"ingestedAt":"2026-11-08T02:43:18.682Z","slug":"CVE-2026-123536","body":"## Overview\n\nOpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows administrators, including delegated realm administrators, to make the server fetch arbitrary URLs through federation configuration wizard metadata URLs. Attackers can enter metadata or OpenID Connect discovery URLs pointing to internal hosts or cloud metadata endpoints to probe the internal network and read partial responses.\n\n## Affected\n\n- `OpenAM < 16.1.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":23,"depthScoreParts":{"impact":22.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}