Live › vulnerability › CVE-2026-44202
Go to dashboardOpenAM's /sessionservice endpoint does not restrict which URLs a logged-in user can register for session event notifications. An authenticated attacker can make the server send outbound requests to arbitrary destinations, potentially exposing session-related data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 15:29 UTC, 0h before NVD. All times on this page are UTC.
Teams running OpenAM or earlier as an SSO or identity gateway. The attacker needs a valid authenticated session, so exposure depends on who can log in. Deployments on newer releases can skip it.
16.0.6| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.openidentityplatform.openam:openam-core | maven | <= 16.0.6 | 16.1.1 |
openam-core version in the project's Maven dependencies; affected versions are <= 16.0.6./sessionservice endpoint is reachable from outside the network.org.openidentityplatform.openam:openam-core to 16.1.1.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenAM (Open Identity Platform) is an open-source Identity and Access Management (IAM) platform derived from ForgeRock OpenAM, providing SSO, OAuth2, SAML, and OpenID Connect capabilities. It is widely deployed in enterprise environments as a central authentication gateway.
The /sessionservice endpoint, used for internal session management operations, does not sufficiently restrict the URLs that authenticated users may register for session event notifications. Under certain conditions, this may result in outbound server-side requests to attacker-controlled destinations, potentially exposing session-related data.
This behavior results in a server-side request forgery (SSRF) vulnerability, where an authenticated attacker can trigger outbound requests to arbitrary destinations.
Discovered by JD-Security SHENYI Team
This page as .md · .json · in your agent: get_signal("CVE-2026-44202")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.