CVE-2026-123536 · Other
NO FIX YET · SEE WHAT TO DO
OpenAM before 16.1.4 lets administrators, including delegated realm administrators, make the server request arbitrary URLs through federation configuration wizard metadata fields. An attacker with that role can probe internal hosts and cloud metadata endpoints and read partial responses.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organizations running OpenAM before 16.1.4 where administrators or delegated realm administrators use the federation configuration wizard. The risk depends on those accounts being able to reach the wizard; the sources do not describe other configurations. Teams on 16.1.4 or later are not affected.
Not affected if no-federation-wizard-access, openam-16.1.4-or-later
Who cares identity, openam, self-hosted
16.1.416.1.4 or laterOpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows administrators, including delegated realm administrators, to make the server fetch arbitrary URLs through federation configuration wizard metadata URLs. Attackers can enter metadata or OpenID Connect discovery URLs pointing to internal hosts or cloud metadata endpoints to probe the internal network and read partial responses.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.