---
id: CVE-2026-123537
title: OpenAM before 16.1.4 SSRF via UMA Scope Description URLs
summary: >-
  OpenAM before 16.1.4 contains a server-side request forgery vulnerability that
  allows parties registering UMA resource sets to trigger internal requests
  through unvalidated scope description URLs. Attackers can register resource
  sets wit…
severity: medium
cvss: 5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-918
vendor: OpenIdentityPlatform
product: OpenAM
affected:
  - OpenAM < 16.1.4
published: '2026-11-08'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T01:37:44.525Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123537'
references:
  - url: >-
      https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-7q42-6xr7-9rmw
    label: GitHub Security Advisory (GHSA-7q42-6xr7-9rmw)
  - url: >-
      https://www.vulncheck.com/advisories/openam-before-16.1.4-ssrf-via-uma-scope-description-urls
    label: >-
      VulnCheck Advisory: OpenAM before 16.1.4 SSRF via UMA Scope Description
      URLs
tags:
  - cve.org
ingestedAt: '2026-11-08T02:43:18.682Z'
---

## Overview

OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows parties registering UMA resource sets to trigger internal requests through unvalidated scope description URLs. Attackers can register resource sets with scope URLs pointing to internal hosts or cloud metadata endpoints, which OpenAM fetches when sending pending-request notification emails, enabling internal network probing.

## Affected

- `OpenAM < 16.1.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.