---
id: "CVE-2026-123536"
page: "https://infrastack.ai/live/CVE-2026-123536"
kind: "vulnerability"
aliases: ["CVE-2026-123536"]
title: "OpenAM: federation wizard lets administrators make server fetch internal URLs"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["identity", "openam", "other", "self-hosted"]
not_affected_if: ["no-federation-wizard-access", "openam-16.1.4-or-later"]
published_at: "2026-11-08T02:16:44+00:00"
first_seen_at: "2026-11-08T02:21:10+00:00"
updated_at: "2026-11-08T02:25:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123536", "first_seen_at": "2026-11-08T02:21:10+00:00"}]
exploit_sources: []
---

# OpenAM: federation wizard lets administrators make server fetch internal URLs

Link for people: https://infrastack.ai/live/CVE-2026-123536 (this .md is for agents)

OpenAM before 16.1.4 lets administrators, including delegated realm administrators, make the server request arbitrary URLs through federation configuration wizard metadata fields. An attacker with that role can probe internal hosts and cloud metadata endpoints and read partial responses.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OpenAM version and compare it with `16.1.4`
- Review which accounts hold administrator or delegated realm administrator roles

## Fix

- OpenAM: upgrade to `16.1.4` or later

## Timeline

- 2026-11-08T02:21:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123536

## Documents

- [advisory] Vendor advisory: github.com https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-rmw3-j353-w9f7
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openam-before-16.1.4-ssrf-via-federation-configuration-wizard-metadata-urls

## From the sources

OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows administrators, including delegated realm administrators, to make the server fetch arbitrary URLs through federation configuration wizard metadata URLs. Attackers can enter metadata or OpenID Connect discovery URLs pointing to internal hosts or cloud metadata endpoints to probe the internal network and read partial responses.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_