All vulnerabilities
CVE-2026-44202GHSA-c556-q2mh-477v

OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`

OpenIdentityPlatform org.openidentityplatform.openam:openam-coremavenLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.2Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.41%Chance of exploitation activity in the next 30 days, higher than 35% of CVEs. Scored 28 Oct 2026FIRST EPSS
Fixed in16.1.1Fixed versionGitHub
Published15 Sep 2026Updated 28 Oct 2026CVE List

What fixes it

  • 16.1.1org.openidentityplatform.openam:openam-core, mavenGitHub<dependency><groupId>org.openidentityplatform.openam</groupId><artifactId>openam-core</artifactId><version>16.1.1</version></dependency>
  • 16.1.1org.openidentityplatform.openam:openam-core, MavenOSV<dependency><groupId>org.openidentityplatform.openam</groupId><artifactId>openam-core</artifactId><version>16.1.1</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

OpenAM (Open Identity Platform) is an open-source Identity and Access Management (IAM) platform derived from ForgeRock OpenAM, providing SSO, OAuth2, SAML, and OpenID Connect capabilities. It is widely deployed in enterprise environments as a central authentication gateway.

The /sessionservice endpoint, used for internal session management operations, does not sufficiently restrict the URLs that authenticated users may register for session event notifications. Under certain conditions, this may result in outbound server-side requests to attacker-controlled destinations, potentially exposing session-related data.

This behavior results in a server-side request forgery (SSRF) vulnerability, where an authenticated attacker can trigger outbound requests to arbitrary destinations.

Credit

Discovered by JD-Security SHENYI Team

Text from GitHub Advisory Database

Affected versions 43

  • org.openidentityplatform.openam:openam-core, maven<= 16.0.6GitHub
  • OpenAMaffected: < 16.1.1CVE List
  • org.openidentityplatform.openam:openam-core, Mavenfrom first release, fixed in 16.1.1OSV
  • org.openidentityplatform.openam:openam-core, Maven14.5.2OSV
  • org.openidentityplatform.openam:openam-core, Maven14.5.3OSV
  • org.openidentityplatform.openam:openam-core, Maven14.5.4OSV
  • org.openidentityplatform.openam:openam-core, Maven14.6.1OSV
  • org.openidentityplatform.openam:openam-core, Maven14.6.2OSV
  • org.openidentityplatform.openam:openam-core, Maven14.6.3OSV
  • org.openidentityplatform.openam:openam-core, Maven14.6.4OSV
  • org.openidentityplatform.openam:openam-core, Maven14.6.5OSV
  • org.openidentityplatform.openam:openam-core, Maven14.6.6OSV
  • org.openidentityplatform.openam:openam-core, Maven14.7.0OSV
  • org.openidentityplatform.openam:openam-core, Maven14.7.1OSV
  • org.openidentityplatform.openam:openam-core, Maven14.7.2OSV
  • org.openidentityplatform.openam:openam-core, Maven14.7.3OSV
  • org.openidentityplatform.openam:openam-core, Maven14.7.4OSV
  • org.openidentityplatform.openam:openam-core, Maven14.8.1OSV
  • org.openidentityplatform.openam:openam-core, Maven14.8.2OSV
  • org.openidentityplatform.openam:openam-core, Maven14.8.3OSV
  • org.openidentityplatform.openam:openam-core, Maven14.8.4OSV
  • org.openidentityplatform.openam:openam-core, Maven15.0.0OSV
  • org.openidentityplatform.openam:openam-core, Maven15.0.1OSV
  • org.openidentityplatform.openam:openam-core, Maven15.0.2OSV
  • org.openidentityplatform.openam:openam-core, Maven15.0.3OSV
  • org.openidentityplatform.openam:openam-core, Maven15.0.4OSV
  • org.openidentityplatform.openam:openam-core, Maven15.1.0OSV
  • org.openidentityplatform.openam:openam-core, Maven15.1.1OSV
  • org.openidentityplatform.openam:openam-core, Maven15.1.2OSV
  • org.openidentityplatform.openam:openam-core, Maven15.1.3OSV
  • org.openidentityplatform.openam:openam-core, Maven15.1.4OSV
  • org.openidentityplatform.openam:openam-core, Maven15.1.5OSV
  • org.openidentityplatform.openam:openam-core, Maven15.1.6OSV
  • org.openidentityplatform.openam:openam-core, Maven15.2.0OSV
  • org.openidentityplatform.openam:openam-core, Maven15.2.1OSV
  • org.openidentityplatform.openam:openam-core, Maven15.2.2OSV
  • org.openidentityplatform.openam:openam-core, Maven16.0.1OSV
  • org.openidentityplatform.openam:openam-core, Maven16.0.2OSV
  • org.openidentityplatform.openam:openam-core, Maven16.0.3OSV
  • org.openidentityplatform.openam:openam-core, Maven16.0.4OSV
  • org.openidentityplatform.openam:openam-core, Maven16.0.5OSV
  • org.openidentityplatform.openam:openam-core, Maven16.0.6OSV
  • org.openidentityplatform.openam:openam-core, Maven16.1.0OSV

References 5