OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`
OpenAM (Open Identity Platform) is an open-source Identity and Access Management (IAM) platform derived from ForgeRock OpenAM, providing SSO, OAuth2, SAML, and OpenID Connect capabilities. It is widely deployed in enterprise environments as a central authentication gateway. The `/sessionservice` endpoint, used for internal session management operations, does not sufficiently restrict the URLs that authenticated users may register for session event notifications. Under certain conditions, this may result in outbound server-side requests to attacker-controlled destinations, potentially exposing session-related data. This behavior results in a **server-side request forgery (SSRF)** vulnerability, where an authenticated attacker can trigger outbound requests to arbitrary destinations. ## Credit Discovered by **JD-Security SHENYI Team**
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-44202US | — | — | ||
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the /sessionservice addSessionListener operation allows an authenticated user to register an arbi… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/OpenIdentityPlatform/OpenAMPACKAGE
- https://github.com/OpenIdentityPlatform/OpenAM/commit/a13a4b63ae0e0670c63cbcfa79586407408b3920WEB
- https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1WEB
- https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-c556-q2mh-477vWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-44202ADVISORY
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan