CVE-2026-123552Medium· 6.5▾ SunlitOpenAM before 16.1.4 contains a server-side request forgery vulnerability in certificate CRL checking that fetches CRLs from the distribution point named in a presented certificate without restricting the destination or verifying the dow…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
OpenAM before 16.1.4 contains a server-side request forgery vulnerability in certificate CRL checking that fetches CRLs from the distribution point named in a presented certificate without restricting the destination or verifying the downloaded CRL's signature. Attackers holding a trusted-CA-chained certificate can make OpenAM request internal hosts, capture configured CRL update credentials, overwrite stored revocation data to block certificate authentication for that CA, and tie up authentication threads.
OpenAM < 16.1.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123537Medium· 5.0OpenAM before 16.1.4 SSRF via UMA Scope Description URLs
CVE-2026-123536Medium· 4.1OpenAM before 16.1.4 SSRF via Federation Configuration Wizard Metadata URLs
CVE-2026-105122Medium· 5.4OpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able to register or modify OAuth 2.0 clients to make OpenAM fetch internal resources via an unvalidated jwks_uri
CVE-2026-44202Medium· 5.3Open Access Management (OpenAM) is an access management solution
CVE-2026-123538Medium· 6.6OpenAM before 16.1.4 SAML 1.x Signature Verification Issuer Impersonation
CVE-2026-123539Medium· 4.8OpenAM before 16.1.4 Stored XSS via OAuth 2.0 Consent Page Display Name