---
id: "CVE-2026-123537"
page: "https://infrastack.ai/live/CVE-2026-123537"
kind: "vulnerability"
aliases: ["CVE-2026-123537"]
title: "OpenAM: unvalidated UMA scope URLs let attackers probe internal hosts"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "openam", "self-hosted", "sso", "uma"]
not_affected_if: ["uma-not-used", "version-16.1.4-or-later"]
published_at: "2026-11-08T02:16:44+00:00"
first_seen_at: "2026-11-08T02:21:10+00:00"
updated_at: "2026-11-08T02:25:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123537", "first_seen_at": "2026-11-08T02:21:10+00:00"}]
exploit_sources: []
---

# OpenAM: unvalidated UMA scope URLs let attackers probe internal hosts

Link for people: https://infrastack.ai/live/CVE-2026-123537 (this .md is for agents)

OpenAM versions before 16.1.4 fetch scope description URLs supplied when registering UMA resource sets, without validating them. An attacker who can register resource sets can make the server request internal hosts or cloud metadata endpoints, exposing internal network details.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OpenAM version and whether it is below `16.1.4`
- Look for UMA resource set registration enabled for users who should not register them

## Fix

- OpenAM: move to `16.1.4` or later

## Timeline

- 2026-11-08T02:21:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123537

## Documents

- [advisory] Vendor advisory: github.com https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-7q42-6xr7-9rmw
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openam-before-16.1.4-ssrf-via-uma-scope-description-urls

## From the sources

OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows parties registering UMA resource sets to trigger internal requests through unvalidated scope description URLs. Attackers can register resource sets with scope URLs pointing to internal hosts or cloud metadata endpoints, which OpenAM fetches when sending pending-request notification emails, enabling internal network probing.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_