CVE-2026-55414

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. From 1.1.0 until 3.0.4, and in 3.1.0, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL...

CVE-2026-55414 NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. From 1.1.0 until 3.0.4, and in 3.1.0, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL...

CVE-2026-55414 NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. From 1.1.0 until 3.0.4, and in 3.1.0, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL...

EUVD-2026-102226

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. From 1.1.0 until 3.0.4, and in 3.1.0, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL...

CVE-2026-55414 NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. From 1.1.0 until 3.0.4, and in 3.1.0, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL...

CVE-2026-55414

The NL Portal Backend Libraries are vulnerable to a Server-Side Request Forgery (SSRF) due to unauthenticated GraphQL resolvers, getFormDefinitionByObjectenApiUrl and getFormDefinitionById, forwarding a caller-influenced URL. These resolvers lack CommonGroundAuthentication and forward the privile...

GHSA-XM3X-9CFW-JHX4 NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)

Summary The public GraphQL resolvers getFormDefinitionByObjectenApiUrlurl and the deprecated getFormDefinitionByIdid fetch a caller-supplied URL using the privileged Objecten-API token. Because the /graphql endpoint is permitAll and these resolvers do not declare a CommonGroundAuthentication...

NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)

Summary The public GraphQL resolvers getFormDefinitionByObjectenApiUrlurl and the deprecated getFormDefinitionByIdid fetch a caller-supplied URL using the privileged Objecten-API token. Because the /graphql endpoint is permitAll and these resolvers do not declare a CommonGroundAuthentication...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the getFormDefinitionByObjectenApiUrl and getFormDefinitionById resolvers, which forward a privileged token to a caller-supplied URL on the configured Objecten-API host without proper authorization...

PT-2026-50973

Name of the Vulnerable Software and Affected Versions NL Portal Backend Libraries versions 1.1.0 through 3.0.3 NL Portal Backend Libraries version 3.1.0 Description Unauthenticated users can access the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL resolvers...

com.ritense.valtimo:object-management (>=12.0.0.release, <=12.12.0.release), com.ritense.valtimo:objecten-api-authentication (>=12.0.0.release, <=12.12.0.release) +6 more potentially affected by CVE-2025-48881 via com.ritense.valtimo:objecten-api (>=12.0.0.release, <=12.12.0.release)

com.ritense.valtimo:objecten-api MAVEN version =12.0.0.release, =12.0.0.release, =12.0.0.release, =12.0.0.release, =12.0.0.release, =12.0.0.release, =12.0.0.release, =1.0.0, =0.1.0, =0.4.0 Source cves: CVE-2025-48881 Source advisory: OSV:GHSA-965R-9CG9-G42P...