OpenIdentityPlatform
CVE-2026-123537: OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows parties registering UMA resource sets to trigger internal requests through
CVE-2026-123537 Nov 8, 2026 Source: Vendor
OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows parties registering UMA resource sets to trigger internal requests through unvalidated scope description URLs. Attackers can register resource sets with scope URLs pointing to internal hosts or cloud metadata endpoints, which OpenAM fetches when sending pending-request notification emails, enabling internal network probing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-123537
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
1 line
No lines match.
, clear filters
Nothing here matches those filters. Clear them to see all 1 lines.