CVE-2026-123536

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.4

Description Administrators, including delegated realm administrators, can trigger a server-side request forgery (SSRF) by providing arbitrary URLs through the federation configuration wizard metadata URLs. This allows the server to fetch content from internal hosts or cloud metadata endpoints, enabling the probing of internal networks and the reading of partial responses. This occurs when metadata or OpenID Connect discovery URLs are processed.

Recommendations Update to version 16.1.4 or later.