---
id: CVE-2026-123536
title: OpenAM before 16.1.4 SSRF via Federation Configuration Wizard Metadata URLs
summary: >-
  OpenAM before 16.1.4 contains a server-side request forgery vulnerability that
  allows administrators, including delegated realm administrators, to make the
  server fetch arbitrary URLs through federation configuration wizard metadata
  URLs…
severity: medium
cvss: 4.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-918
vendor: OpenIdentityPlatform
product: OpenAM
affected:
  - OpenAM < 16.1.4
published: '2026-11-08'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T01:37:43.836Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123536'
references:
  - url: >-
      https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-rmw3-j353-w9f7
    label: GitHub Security Advisory (GHSA-rmw3-j353-w9f7)
  - url: >-
      https://www.vulncheck.com/advisories/openam-before-16.1.4-ssrf-via-federation-configuration-wizard-metadata-urls
    label: >-
      VulnCheck Advisory: OpenAM before 16.1.4 SSRF via Federation Configuration
      Wizard Metadata URLs
tags:
  - cve.org
ingestedAt: '2026-11-08T02:43:18.682Z'
---

## Overview

OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows administrators, including delegated realm administrators, to make the server fetch arbitrary URLs through federation configuration wizard metadata URLs. Attackers can enter metadata or OpenID Connect discovery URLs pointing to internal hosts or cloud metadata endpoints to probe the internal network and read partial responses.

## Affected

- `OpenAM < 16.1.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.