https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T16:03:27.984079+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-368590 EUVD-2026-368590 2026-10-03T16:03:28.074572+00:00 EUVD-2026-368590 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44202 fkie_cve-2026-44202 2026-10-03T16:03:28.074605+00:00

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the /sessionservice addSessionListener operation allows an authenticated user to register an arbitrary notification URL without requiring an administrative or application client token. SessionRequestHandler passes the attacker-controlled destination to the session listener service, causing the OpenAM server to make outbound requests and potentially disclose session-related notification data to an attacker-controlled destination. This issue is fixed in version 16.1.1.

 https://cve.radiocsirt.org/vuln/ghsa-c556-q2mh-477v GHSA-c556-q2mh-477v — OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice` 2026-10-03T16:03:28.074638+00:00

Affected: Maven: org.openidentityplatform.openam:openam-core

OpenAM (Open Identity Platform) is an open-source Identity and Access Management (IAM) platform derived from ForgeRock OpenAM, providing SSO, OAuth2, SAML, and OpenID Connect capabilities. It is widely deployed in enterprise environments as a central authentication gateway.

The `/sessionservice` endpoint, used for internal session management operations, does not sufficiently restrict the URLs that authenticated users may register for session event notifications. Under certain conditions, this may result in outbound server-side requests to attacker-controlled destinations, potentially exposing session-related data.

This behavior results in a **server-side request forgery (SSRF)** vulnerability, where an authenticated attacker can trigger outbound requests to arbitrary destinations.

## Credit

Discovered by **JD-Security SHENYI Team**

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-44202 UBUNTU-CVE-2026-44202 2026-10-03T16:03:28.074670+00:00

Affected: Ubuntu:16.04:LTS: openam

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the /sessionservice addSessionListener operation allows an authenticated user to register an arbitrary notification URL without requiring an administrative or application client token. SessionRequestHandler passes the attacker-controlled destination to the session listener service, causing the OpenAM server to make outbound requests and potentially disclose session-related notification data to an attacker-controlled destination. This issue is fixed in version 16.1.1.