7 matches found
CVE-2026-123536
OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows administrators, including delegated realm administrators, to make the server fetch arbitrary URLs through federation configuration wizard metadata URLs. Attackers can enter metadata or OpenID Connect discovery...
EUVD-2026-119421
OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows administrators, including delegated realm administrators, to make the server fetch arbitrary URLs through federation configuration wizard metadata URLs. Attackers can enter metadata or OpenID Connect discovery...
CVE-2026-123536 OpenAM before 16.1.4 SSRF via Federation Configuration Wizard Metadata URLs
OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows administrators, including delegated realm administrators, to make the server fetch arbitrary URLs through federation configuration wizard metadata URLs. Attackers can enter metadata or OpenID Connect discovery...
CVE-2026-123536
OpenAM versions prior to 16.1.4 are susceptible to a Server-Side Request Forgery (SSRF) vulnerability. This flaw allows administrators, including delegated realm administrators, to force the server to fetch arbitrary URLs via federation configuration wizard metadata URLs . An attacker with suffic...
CVE-2026-123536 OpenAM before 16.1.4 SSRF via Federation Configuration Wizard Metadata URLs
OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows administrators, including delegated realm administrators, to make the server fetch arbitrary URLs through federation configuration wizard metadata URLs. Attackers can enter metadata or OpenID Connect discovery...
CVE-2026-123536: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows administrators, including…
OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows administrators, including delegated realm administrators, to make the server fetch arbitrary URLs through federation configuration wizard metadata URLs. Attackers can enter metadata or OpenID Connect discovery...
PT-2026-139817
OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows administrators, including delegated realm administrators, to make the server fetch arbitrary URLs through federation configuration wizard metadata URLs. Attackers can enter metadata or OpenID Connect discovery...