AIKIDO-2026-355958
openam-certs is vulnerable to Server-Side Request Forgery (SSRF)
65
Medium Risk
This Affects:
openam-certsTL;DR
When CRL checking is enabled in the certificate authentication module, OpenAM fetches the CRL Distribution Point URL taken from a presented client certificate before completing PKIX trust-chain validation in CRLValidator. An unauthenticated caller can present a self-signed certificate carrying a crafted crlDistributionPoints extension and make the server issue an HTTP request to an arbitrary URL. Because the fetch happens before the untrusted certificate is rejected, no valid certificate is required and internal services or cloud metadata endpoints become reachable. The fix validates the trust chain first so an untrusted certificate distribution point is never fetched.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you enable certificate authentication with CRL update from the certificate's distribution point.
Background info
openam-certs is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.0.1 - 16.1.1.
How to fix this
Upgrade the org.openidentityplatform.openam:openam-certs library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant