TI-2026-32181 Aliases CVE-2026-44202 GHSA-c556-q2mh-477v

OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`

LOW 24CWE-918Published 2026-09-15 · Updated 2026-09-15

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the /sessionservice addSessionListener operation allows an authenticated user to register an arbitrary notification URL without requiring an administrative or application client token. SessionRequestHandler passes the attacker-controlled destination to the session listener service, causing the OpenAM server to make outbound requests and potentially disclose session-related notification data to an attacker-controlled destination. This issue is fixed in version 16.1.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00414 35th percentileScored 2026-11-07

Fix Fixed OpenAM (OpenIdentityPlatform): 16.1.1org.openidentityplatform.openam:openam-core (Maven): 16.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenIdentityPlatform	OpenAM	before 16.1.1	16.1.1	Patch available	CNA
—	org.openidentityplatform.openam:openam-core (Maven)	before 16.1.1	16.1.1	Patch available	GHSA-c556-q2mh-477v

OpenAM VendorOpenIdentityPlatform Affected before 16.1.1 Fixed in 16.1.1 Patch available CNA
org.openidentityplatform.openam:openam-core (Maven) Vendor— Affected before 16.1.1 Fixed in 16.1.1 Patch available GHSA-c556-q2mh-477v

Remediation

Fix · CNA OpenAM (OpenIdentityPlatform) Fixed in 16.1.1
Fix · GHSA-c556-q2mh-477v org.openidentityplatform.openam:openam-core (Maven) Fixed in 16.1.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-44202
2026-10-03 Alias added: GHSA-c556-q2mh-477v
2026-10-28 2 new references · GHSA-c556-q2mh-477v

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-44202

Other 4

TI-2025-20332 OpenDJ Denial of Service (Dos) using alias loop CVSS 4.0HIGH 8.7
TI-2026-25836 Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM CVSS 4.0CRITICAL 9.3
TI-2026-86693 Session token disclosure in OpenAM notification WebSocket CVSS 4.0CRITICAL 10.0
TI-2026-86692 Authentication bypass in OpenAM SAML login accepts unsigned assertions CVSS 4.0CRITICAL 9.3
TI-2026-86691 Privilege escalation in OpenAM via self-registration attribute bypass CVSS 4.0CRITICAL 9.3
TI-2026-86685 Unbounded Java deserialization in OpenAM enables denial of service CVSS 4.0HIGH 8.7

See all 54 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences