AIKIDO-2026-50354
openam-core is vulnerable to Server-Side Request Forgery (SSRF)
73
High Risk
This Affects:
openam-coreTL;DR
The legacy JAXRPC endpoint lets a caller register an arbitrary callback URL through registerNotificationURL and registerNotificationURL_idrepo without authentication. OpenAM then sends a server-side HTTP POST to every registered URL on each service-configuration change, producing a persistent stored server-side request forgery. Notification payloads carrying configuration-change details are delivered to the chosen destination, and the callback fires until the server restarts. The fix requires the caller to be an authenticated server or agent and adds a runtime toggle.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and the legacy /jaxrpc/* endpoint is reachable by untrusted callers.
Background info
openam-core is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.0.1 - 16.1.1.
How to fix this
Upgrade the org.openidentityplatform.openam:openam-core library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant