CVE-2026-123552 · Other
NO FIX YET · SEE WHAT TO DO
OpenAM fetches certificate revocation lists from addresses named inside a presented certificate without restricting the destination or verifying the list's signature. An attacker holding a certificate from a trusted certificate authority can make the server request internal hosts, read stored CRL credentials, overwrite revocation data, and tie up authentication threads.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
OpenAM deployments before 16.1.4 that use certificate-based authentication with CRL checking are exposed. An attacker must hold a certificate chained to a CA the deployment trusts. Deployments on 16.1.4 or later, or without certificate authentication, can skip it.
Not affected if no-certificate-auth, version-16.1.4-or-later
Who cares certificate-auth, openam, self-hosted
16.1.4 or later is not affected by the description given.16.1.4: move to 16.1.4 or later.OpenAM before 16.1.4 contains a server-side request forgery vulnerability in certificate CRL checking that fetches CRLs from the distribution point named in a presented certificate without restricting the destination or verifying the downloaded CRL's signature. Attackers holding a trusted-CA-chained certificate can make OpenAM request internal hosts, capture configured CRL update credentials, overwrite stored revocation data to block certificate authentication for that CA, and tie up authentication threads.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.