Is there a patch available for CVE-2026-44202?

Yes, a patch is available for CVE-2026-44202. Update the affected software to the latest version immediately.

OpenAM CVE-2026-44202

Q: What is the CVSS score of CVE-2026-44202?

CVE-2026-44202 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-78355 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-22 https://github.com/OpenIdentityPlatform/OpenAM

GHSA-c556-q2mh-477v

SSRF

5.3

CVSS 4.0 · Vendor: https://github.com/OpenIdentityPlatform/OpenAM

Severity by source

Vendor (https://github.com/OpenIdentityPlatform/OpenAM) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.0 MEDIUM

Network-accessible endpoint requires low-privilege authentication (PR:L); SSRF causes server to contact external systems (S:C), with limited confidentiality impact (C:L) and no integrity or availability impact described.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (https://github.com/OpenIdentityPlatform/OpenAM).

CVSS VectorVendor: https://github.com/OpenIdentityPlatform/OpenAM

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Sep 15, 2026 - 10:22 NVD

5.3 (MEDIUM)

Source Code Evidence Fetched

Jun 22, 2026 - 20:30 vuln.today

Analysis Generated

Jun 22, 2026 - 20:30 vuln.today

DescriptionCVE.org

OpenAM (Open Identity Platform) is an open-source Identity and Access Management (IAM) platform derived from ForgeRock OpenAM, providing SSO, OAuth2, SAML, and OpenID Connect capabilities. It is widely deployed in enterprise environments as a central authentication gateway.

The /sessionservice endpoint, used for internal session management operations, does not sufficiently restrict the URLs that authenticated users may register for session event notifications. Under certain conditions, this may result in outbound server-side requests to attacker-controlled destinations, potentially exposing session-related data.

This behavior results in a server-side request forgery (SSRF) vulnerability, where an authenticated attacker can trigger outbound requests to arbitrary destinations.

Credit

Discovered by JD-Security SHENYI Team

AnalysisAI

Server-Side Request Forgery in OpenAM's /sessionservice endpoint allows authenticated attackers to register arbitrary URLs for session event notifications, causing the IAM server to make outbound HTTP requests to attacker-controlled destinations. Affected versions are org.openidentityplatform.openam:openam-core up to and including 16.0.6; the flaw was patched in release 16.1.1. No public exploit code or CISA KEV listing has been identified at time of analysis, but the authentication barrier is low (any valid session), and deployment context - a central enterprise authentication gateway - elevates the downstream risk of internal network reconnaissance or session data exfiltration.

Technical ContextAI

OpenAM is an open-source IAM platform (Maven artifact org.openidentityplatform.openam:openam-core) derived from ForgeRock OpenAM, providing SSO, OAuth2, SAML, and OpenID Connect services, typically deployed as a central enterprise authentication broker. The vulnerable component is the /sessionservice endpoint, which handles internal session lifecycle operations including registration of callback URLs for session event notifications (e.g., session expiry hooks). CWE-918 (Server-Side Request Forgery) identifies the root cause: user-supplied URL values are not validated or restricted before the server uses them to make outbound HTTP requests. Because the OpenAM server acts as the HTTP client, the SSRF occurs in the context of the server's network identity - potentially reaching internal services, cloud metadata endpoints (e.g., 169.254.169.254), or other resources inaccessible directly to the attacker.

RemediationAI

Upgrade org.openidentityplatform.openam:openam-core to version 16.1.1 or later, as confirmed by the GitHub release at https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1 and the security advisory at https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-c556-q2mh-477v. If immediate upgrade is not possible, restrict outbound HTTP connectivity from the OpenAM server at the network layer - specifically block access to RFC-1918 address ranges, cloud metadata endpoints (169.254.169.254, fd00:ec2::254), and any internal services not required by OpenAM's operational role; this limits SSRF reach without disabling the feature. Additionally, enforce egress filtering via an HTTP proxy with an allowlist of permitted destinations, routing all OpenAM outbound traffic through it. Note that neither workaround eliminates the vulnerability - they reduce blast radius only. Disabling or restricting access to the /sessionservice endpoint entirely may disrupt legitimate session management operations and should only be considered with vendor guidance.