CVE-2026-123537

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.4

Description An issue exists where parties registering UMA resource sets can trigger internal requests via unvalidated scope description URLs. This occurs because the system fetches these URLs when sending pending-request notification emails. An attacker can provide URLs pointing to internal hosts or cloud metadata endpoints to perform internal network probing. Server-side request forgery (SSRF) is a flaw where a server is tricked into making requests to an unintended location.

Recommendations Update to version 16.1.4.