# CVE-2026-123537: OpenAM server-side request forgery in UMA scope description

Source: https://junglewise.ai/threats/cve-2026-123537-openam-before-16-1-4-contains-a-server-side-request-forgery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-123537 · Severity: medium · CVSS 5 · Published 2026-11-08

OpenAM is an identity and access management platform used to control who can access enterprise applications and resources. An attacker with the ability to register resource sets in OpenAM's User-Managed Access (UMA) feature can force the OpenAM server to make HTTP requests to internal systems, including cloud metadata endpoints, that should not be reachable from the outside. This allows probing of internal networks and potential exposure of sensitive metadata, though responses are mostly not visible to the attacker.

Technologies: [Open Identity Platform OpenAM](https://junglewise.ai/threats/technologies/openam). Vendors: [Open Identity Platform](https://junglewise.ai/threats/vendors/open-identity-platform).

## Quick answers

**Is CVE-2026-123537 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123537 being exploited in the wild.

**How severe is CVE-2026-123537?** Medium severity, with a CVSS score of 5, published 8 November 2026.

**Which products and versions are affected?** Open Identity Platform OpenAM before 16.1.4.

**Is there a fix for CVE-2026-123537?** Yes: fixed in 16.1.4. Until then: Disable UMA in realms that do not use it. Disable pending request notification emails in UMA provider settings to prevent scope description fetching. Restrict outbound traffic from OpenAM servers to legitimate destinations, particularly blocking cloud metadata endpoints and internal administrative interfaces. Only grant the UMA protection scope to trusted resource servers that you control. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123537 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-123537?** Check whether you run Open Identity Platform OpenAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 16.1.4

Disable UMA in realms that do not use it. Disable pending request notification emails in UMA provider settings to prevent scope description fetching. Restrict outbound traffic from OpenAM servers to legitimate destinations, particularly blocking cloud metadata endpoints and internal administrative interfaces. Only grant the UMA protection scope to trusted resource servers that you control.

## Technical details

This is a server-side request forgery (SSRF) vulnerability in OpenAM's UMA implementation. When UMA is enabled, OpenAM fetches scope descriptions from URLs provided during resource set registration without validating whether those URLs point to internal hosts or special-purpose addresses. An attacker with OAuth 2.0 client credentials (resource server role) can supply malicious scope description URLs targeting internal services or cloud metadata endpoints, and OpenAM will fetch them when composing pending-request notification emails, enabling internal network reconnaissance.

## Affected products

- Open Identity Platform OpenAM before 16.1.4

## Timeline

- 2026-10-22: disclosed
- 2026-10-22: patched: OpenAM 16.1.4 released

## References

- [https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-7q42-6xr7-9rmw](https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-7q42-6xr7-9rmw)
- [https://www.vulncheck.com/advisories/openam-before-16.1.4-ssrf-via-uma-scope-description-urls](https://www.vulncheck.com/advisories/openam-before-16.1.4-ssrf-via-uma-scope-description-urls)

## Related threats

- [OpenAM default credentials authentication bypass in built-in identities](https://junglewise.ai/threats/cve-2026-123553-openam-before-16-1-4-ships-built-in-identities-in-the-top-level)
- [OpenAM unauthenticated session token disclosure via WebSocket](https://junglewise.ai/threats/cve-2026-123551-openam-from-14-0-0-before-16-1-4-contains-an-information)
- [OpenAM SAML v2.0 service provider authentication bypass](https://junglewise.ai/threats/cve-2026-123550-openam-before-16-1-4-contains-an-authentication-bypass)
- [OpenAM self-registration attribute list enforcement bypass](https://junglewise.ai/threats/cve-2026-123549-openam-before-16-1-4-fails-to-enforce-the-valid-creation)
- [OpenAM open redirect via SAML RelayState](https://junglewise.ai/threats/cve-2026-123547-openam-before-16-1-4-contains-an-open-redirect-vulnerability)