CVE-2026-44202 OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`
Authenticated attackers can trigger server-side requests to arbitrary URLs via the session service, potentially disclosing sensitive session data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44202?
CVE-2026-44202 is a medium-severity server-side request forgery vulnerability in OpenIdentityPlatform OpenAM, published on 15 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the /sessionservice addSessionListener operation allows an authenticated user to register an arbitrary notification URL without requiring an administrative or application client token. SessionRequestHandler passes the attacker-controlled destination to the session listener service, causing the OpenAM server to make outbound requests and potentially disclose session-related notification data to an attacker-controlled destination. This issue is fixed in version 16.1.1.
Weakness: CWE-918
Which versions are affected by CVE-2026-44202?
2 open source packages ship an affected version, including org.openidentityplatform.openam:openam-core.
| Package | Affected | Fixed in |
|---|---|---|
org.openidentityplatform.openam:openam-core Maven | All versions | 16.1.1 |
org.openidentityplatform.openam:openam-core Maven | All versions | 16.1.1 |
How do I fix CVE-2026-44202?
Upgrade org.openidentityplatform.openam:openam-core to 16.1.1 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-44202 being exploited?
There is no known exploitation of CVE-2026-44202 in the wild and no public exploit code.
Sources
Also known as GHSA-c556-q2mh-477v, UBUNTU-CVE-2026-44202.