CVE-2026-44202 json
OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`
published 2026-06-22 4 mo ago modified 2026-10-28 12 d ago also EUVD-2026-78355 , GHSA-c556-q2mh-477v
- cvss
- 5.3
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 35%
- public exploits
- 0
- none known
Summary
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the /sessionservice addSessionListener operation allows an authenticated user to register an arbitrary notification URL without requiring an administrative or application client token. SessionRequestHandler passes the attacker-controlled destination to the session listener service, causing the OpenAM server to make outbound requests and potentially disclose session-related notification data to an attacker-controlled destination. This issue is fixed in version 16.1.1.
Patch / fix
- maven org.openidentityplatform.openam:openam-core 16.1.1
- openidentityplatform openam 16.1.1
- org.openidentityplatform.openam openam-core 16.1.1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 55 d ago
Exploit prediction
0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.openidentityplatform.openam:openam-core | <16.1.1 |
16.1.1 |
Affected products
- OpenIdentityPlatform OpenAM
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/OpenIdentityPlatform/OpenAM/commit/a13a4b63ae0e0670c63cbcfa79586407408b3920
web
-
github.com
/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-c556-q2mh-477v
web
-
github.com
/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-44202
advisory
-
github.com
/OpenIdentityPlatform/OpenAM
package
Sources
- CVE List CVE-2026-44202
- GitHub Advisory GHSA-c556-q2mh-477v
- NVD CVE-2026-44202
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.