CVE-2026-123537 · Infrastructure
NO FIX YET · SEE WHAT TO DO
OpenAM versions before 16.1.4 fetch scope description URLs supplied when registering UMA resource sets, without validating them. An attacker who can register resource sets can make the server request internal hosts or cloud metadata endpoints, exposing internal network details.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
OpenAM deployments before 16.1.4 that allow parties to register UMA resource sets are exposed, since the server fetches the scope URLs it is given when sending pending-request emails. Deployments that do not use UMA resource set registration, or that restrict who can register them, have a smaller exposure. Sources do not state a specific configuration default.
Not affected if uma-not-used, version-16.1.4-or-later
Who cares openam, self-hosted, sso, uma
16.1.416.1.4 or laterOpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows parties registering UMA resource sets to trigger internal requests through unvalidated scope description URLs. Attackers can register resource sets with scope URLs pointing to internal hosts or cloud metadata endpoints, which OpenAM fetches when sending pending-request notification emails, enabling internal network probing.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.