{"id":"CVE-2026-123537","kind":"vulnerability","aliases":["CVE-2026-123537"],"related":[],"title":"OpenAM: unvalidated UMA scope URLs let attackers probe internal hosts","description":"OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows parties registering UMA resource sets to trigger internal requests through unvalidated scope description URLs. Attackers can register resource sets with scope URLs pointing to internal hosts or cloud metadata endpoints, which OpenAM fetches when sending pending-request notification emails, enabling internal network probing.","summary":"OpenAM versions before 16.1.4 fetch scope description URLs supplied when registering UMA resource sets, without validating them. An attacker who can register resource sets can make the server request internal hosts or cloud metadata endpoints, exposing internal network details.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","openam","self-hosted","sso","uma"],"not_affected_if":["uma-not-used","version-16.1.4-or-later"],"how_to_check":"- Check the installed OpenAM version and whether it is below `16.1.4`\n- Look for UMA resource set registration enabled for users who should not register them","fix":"- OpenAM: move to `16.1.4` or later","status":"open","published_at":"2026-11-08T02:16:44+00:00","first_seen_at":"2026-11-08T02:21:10+00:00","triaged_at":"2026-11-08T02:25:18+00:00","updated_at":"2026-11-08T02:25:18+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-08T02:25:18Z","model":"claude-haiku-5-5","output":{"fix":"- OpenAM: move to `16.1.4` or later","reach":"network","title":"OpenAM: unvalidated UMA scope URLs let attackers probe internal hosts","impact":"medium","summary":"OpenAM versions before 16.1.4 fetch scope description URLs supplied when registering UMA resource sets, without validating them. An attacker who can register resource sets can make the server request internal hosts or cloud metadata endpoints, exposing internal network details.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["openam","self-hosted","uma","sso"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"server makes internal requests, exposing internal hosts and cloud metadata","analyst_note":"","how_to_check":"- Check the installed OpenAM version and whether it is below `16.1.4`\n- Look for UMA resource set registration enabled for users who should not register them","plain_action":"","needs_analyst":false,"not_affected_if":["version-16.1.4-or-later","uma-not-used"],"who_is_affected":"OpenAM deployments before 16.1.4 that allow parties to register UMA resource sets are exposed, since the server fetches the scope URLs it is given when sending pending-request emails. Deployments that do not use UMA resource set registration, or that restrict who can register them, have a smaller exposure. Sources do not state a specific configuration default.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000697,"input_tokens":4296,"output_tokens":534,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123537':13A,16A '-2026':12A,15A '16.1.4':27B,65C 'allow':75C 'attack':7A,42B,90C 'cloud':56B,103C 'contain':66C 'cve':11A,14A 'descript':30B,88C 'detail':62B 'email':115C 'enabl':116C 'endpoint':58B,105C 'expos':59B 'fetch':28B,108C 'forgeri':72C 'host':10A,21B,54B,101C 'infrastructur':17B 'intern':9A,53B,60B,83C,100C,117C 'let':6A 'make':49B 'metadata':57B,104C 'network':61B,118C 'notif':114C 'openam':1A,18B,24B,63C,107C 'parti':76C 'pend':112C 'pending-request':111C 'point':98C 'probe':8A,119C 'regist':34B,45B,77C,92C 'request':52B,71C,84C,113C 'resourc':36B,46B,79C,93C 'scope':4A,29B,87C,96C 'self':20B 'self-host':19B 'send':110C 'server':51B,69C 'server-sid':68C 'set':37B,47B,80C,94C 'side':70C 'sso':22B 'suppli':32B 'trigger':82C 'uma':3A,23B,35B,78C 'unvalid':2A,86C 'url':5A,31B,89C,97C 'valid':39B 'version':25B 'vulner':73C 'without':38B","nicknames":[],"mitigations":[],"who_affected":"OpenAM deployments before 16.1.4 that allow parties to register UMA resource sets are exposed, since the server fetches the scope URLs it is given when sending pending-request emails. Deployments that do not use UMA resource set registration, or that restrict who can register them, have a smaller exposure. Sources do not state a specific configuration default.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","medium","openam","selfhosted","sso","uma"],"campaign_type":null,"search_a":"'-123537':13A,16A '-2026':12A,15A 'attack':7A 'cve':11A,14A 'host':10A 'intern':9A 'let':6A 'openam':1A 'probe':8A 'scope':4A 'uma':3A 'unvalid':2A 'url':5A","search_b":"'16.1.4':27B 'attack':42B 'cloud':56B 'descript':30B 'detail':62B 'endpoint':58B 'expos':59B 'fetch':28B 'host':21B,54B 'infrastructur':17B 'intern':53B,60B 'make':49B 'metadata':57B 'network':61B 'openam':18B,24B 'regist':34B,45B 'request':52B 'resourc':36B,46B 'scope':29B 'self':20B 'self-host':19B 'server':51B 'set':37B,47B 'sso':22B 'suppli':32B 'uma':23B,35B 'url':31B 'valid':39B 'version':25B 'without':38B","search_c":"'16.1.4':65C 'allow':75C 'attack':90C 'cloud':103C 'contain':66C 'descript':88C 'email':115C 'enabl':116C 'endpoint':105C 'fetch':108C 'forgeri':72C 'host':101C 'intern':83C,100C,117C 'metadata':104C 'network':118C 'notif':114C 'openam':63C,107C 'parti':76C 'pend':112C 'pending-request':111C 'point':98C 'probe':119C 'regist':77C,92C 'request':71C,84C,113C 'resourc':79C,93C 'scope':87C,96C 'send':110C 'server':69C 'server-sid':68C 'set':80C,94C 'side':70C 'trigger':82C 'uma':78C 'unvalid':86C 'url':89C,97C 'vulner':73C","first_public_at":"2026-10-22T09:44:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123537","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123537","severity":null,"published_at":"2026-11-08T02:16:44+00:00","modified_at":"2026-11-08T02:16:44+00:00","first_seen_at":"2026-11-08T02:21:10+00:00","fetched_at":"2026-11-08T02:21:10+00:00","note":null}],"documents":[{"id":99223,"url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-7q42-6xr7-9rmw","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T09:44:18+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99224,"url":"https://www.vulncheck.com/advisories/openam-before-16.1.4-ssrf-via-uma-scope-description-urls","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}