{"id":"CVE-2026-123536","kind":"vulnerability","aliases":["CVE-2026-123536"],"related":[],"title":"OpenAM: federation wizard lets administrators make server fetch internal URLs","description":"OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows administrators, including delegated realm administrators, to make the server fetch arbitrary URLs through federation configuration wizard metadata URLs. Attackers can enter metadata or OpenID Connect discovery URLs pointing to internal hosts or cloud metadata endpoints to probe the internal network and read partial responses.","summary":"OpenAM before 16.1.4 lets administrators, including delegated realm administrators, make the server request arbitrary URLs through federation configuration wizard metadata fields. An attacker with that role can probe internal hosts and cloud metadata endpoints and read partial responses.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["identity","openam","other","self-hosted"],"not_affected_if":["no-federation-wizard-access","openam-16.1.4-or-later"],"how_to_check":"- Check the installed OpenAM version and compare it with `16.1.4`\n- Review which accounts hold administrator or delegated realm administrator roles","fix":"- OpenAM: upgrade to `16.1.4` or later","status":"open","published_at":"2026-11-08T02:16:44+00:00","first_seen_at":"2026-11-08T02:21:10+00:00","triaged_at":"2026-11-08T02:25:23+00:00","updated_at":"2026-11-08T02:25:23+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-08T02:25:23Z","model":"claude-haiku-5-5","output":{"fix":"- OpenAM: upgrade to `16.1.4` or later","reach":"network","title":"OpenAM: federation wizard lets administrators make server fetch internal URLs","impact":"medium","summary":"OpenAM before 16.1.4 lets administrators, including delegated realm administrators, make the server request arbitrary URLs through federation configuration wizard metadata fields. An attacker with that role can probe internal hosts and cloud metadata endpoints and read partial responses.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openam","self-hosted","identity"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"internal hosts probed and partial responses read by administrators","analyst_note":"","how_to_check":"- Check the installed OpenAM version and compare it with `16.1.4`\n- Review which accounts hold administrator or delegated realm administrator roles\n- unknown for other checks, the sources do not say","plain_action":"","needs_analyst":false,"not_affected_if":["openam-16.1.4-or-later","no-federation-wizard-access"],"who_is_affected":"Organizations running OpenAM before 16.1.4 where administrators or delegated realm administrators use the federation configuration wizard. The risk depends on those accounts being able to reach the wizard; the sources do not describe other configurations. Teams on 16.1.4 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000694,"input_tokens":4298,"output_tokens":528,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123536':13A,16A '-2026':12A,15A '16.1.4':25B,63C 'administr':5A,27B,31B,74C,78C 'allow':73C 'arbitrari':36B,84C 'attack':45B,92C 'cloud':54B,106C 'configur':40B,88C 'connect':98C 'contain':64C 'cve':11A,14A 'deleg':29B,76C 'discoveri':99C 'endpoint':56B,108C 'enter':94C 'feder':2A,39B,87C 'fetch':8A,83C 'field':43B 'forgeri':70C 'host':22B,52B,104C 'ident':17B 'includ':28B,75C 'intern':9A,51B,103C,112C 'let':4A,26B 'make':6A,32B,80C 'metadata':42B,55B,90C,95C,107C 'network':113C 'openam':1A,18B,23B,61C 'openid':97C 'partial':59B,116C 'point':101C 'probe':50B,110C 'read':58B,115C 'realm':30B,77C 'request':35B,69C 'respons':60B,117C 'role':48B 'self':21B 'self-host':20B 'server':7A,34B,67C,82C 'server-sid':66C 'side':68C 'url':10A,37B,85C,91C,100C 'vulner':71C 'wizard':3A,41B,89C","nicknames":[],"mitigations":[],"who_affected":"Organizations running OpenAM before 16.1.4 where administrators or delegated realm administrators use the federation configuration wizard. The risk depends on those accounts being able to reach the wizard; the sources do not describe other configurations. Teams on 16.1.4 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["identity","medium","openam","other","selfhosted"],"campaign_type":null,"search_a":"'-123536':13A,16A '-2026':12A,15A 'administr':5A 'cve':11A,14A 'feder':2A 'fetch':8A 'intern':9A 'let':4A 'make':6A 'openam':1A 'server':7A 'url':10A 'wizard':3A","search_b":"'16.1.4':25B 'administr':27B,31B 'arbitrari':36B 'attack':45B 'cloud':54B 'configur':40B 'deleg':29B 'endpoint':56B 'feder':39B 'field':43B 'host':22B,52B 'ident':17B 'includ':28B 'intern':51B 'let':26B 'make':32B 'metadata':42B,55B 'openam':18B,23B 'partial':59B 'probe':50B 'read':58B 'realm':30B 'request':35B 'respons':60B 'role':48B 'self':21B 'self-host':20B 'server':34B 'url':37B 'wizard':41B","search_c":"'16.1.4':63C 'administr':74C,78C 'allow':73C 'arbitrari':84C 'attack':92C 'cloud':106C 'configur':88C 'connect':98C 'contain':64C 'deleg':76C 'discoveri':99C 'endpoint':108C 'enter':94C 'feder':87C 'fetch':83C 'forgeri':70C 'host':104C 'includ':75C 'intern':103C,112C 'make':80C 'metadata':90C,95C,107C 'network':113C 'openam':61C 'openid':97C 'partial':116C 'point':101C 'probe':110C 'read':115C 'realm':77C 'request':69C 'respons':117C 'server':67C,82C 'server-sid':66C 'side':68C 'url':85C,91C,100C 'vulner':71C 'wizard':89C","first_public_at":"2026-10-22T10:31:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123536","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123536","severity":null,"published_at":"2026-11-08T02:16:44+00:00","modified_at":"2026-11-08T02:16:44+00:00","first_seen_at":"2026-11-08T02:21:10+00:00","fetched_at":"2026-11-08T02:21:10+00:00","note":null}],"documents":[{"id":99221,"url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-rmw3-j353-w9f7","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T10:31:53+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99222,"url":"https://www.vulncheck.com/advisories/openam-before-16.1.4-ssrf-via-federation-configuration-wizard-metadata-urls","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}