CVE-2026-123552— OpenAM before 16.1.4 SSRF and CRL Tampering via Certificate CRL Distribution Point

Quick assessment

Affected

OpenIdentityPlatform OpenAM

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 16.1.4 版本之前的 OpenAM 存在一个服务器端请求伪造（SSRF）漏洞，该漏洞位于证书吊销列表（CRL）检查功能中。具体而言，系统在从证书中指定的分发点获取 CRL 时，既未限制目标地址，也未验证所下载 CRL 的签名。持有受信任证书颁发机构（CA）链式证书的攻击者，可利用此漏洞诱导 OpenAM 向内部主机发起请求，从而窃取配置的 CRL 更新凭据、覆盖存储的吊销数据以阻断该 CA 的证书认证，并耗尽认证线程资源。

CVSS 6.5 · Medium Updated Nov 08, 2026

Possible ATT&CK Techniques 3 AI

T1068 · Exploitation for Privilege Escalation T1071 · Application Layer Protocol T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

OpenAM before 16.1.4 SSRF and CRL Tampering via Certificate CRL Distribution Point

Source: CVE Program / CVE List V5

Vulnerability Description

OpenAM before 16.1.4 contains a server-side request forgery vulnerability in certificate CRL checking that fetches CRLs from the distribution point named in a presented certificate without restricting the destination or verifying the downloaded CRL's signature. Attackers holding a trusted-CA-chained certificate can make OpenAM request internal hosts, capture configured CRL update credentials, overwrite stored revocation data to block certificate authentication for that CA, and tie up authentication threads.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

服务端请求伪造(SSRF)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
OpenIdentityPlatform	OpenAM	0 ~ 16.1.4	-

II. Public POCs for CVE-2026-123552

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123552

请登录查看更多情报信息。

Other References for CVE-2026-123552 (2)

https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-g5vw-v384-gw9v vendor-advisory
https://www.vulncheck.com/advisories/openam-before-16.1.4-ssrf-and-crl-tampering-via-certificate-crl-distribution-point third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-123552

Same Patch Batch · OpenIdentityPlatform · 2026-11-08 · 18 CVEs total

CVE-2026-123551	10.0 CRITICAL	OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocket
CVE-2026-123550	9.8 CRITICAL	OpenAM before 16.1.4 SAML Authentication Bypass via Unsigned Assertions
CVE-2026-123549	9.8 CRITICAL	OpenAM before 16.1.4 Privilege Escalation via Self-Registration Attribute Bypass
CVE-2026-123543	7.5 HIGH	OpenAM before 16.1.4 Unauthenticated DoS via Unbounded Java Deserialisation
CVE-2026-123545	7.1 HIGH	OpenAM 14.5.1 before 16.1.4 CSRF in OAuth 2.0 Device Flow
CVE-2026-123544	6.8 MEDIUM	OpenAM before 16.1.4 Insufficient Response Validation in Internal SOAP Channel
CVE-2026-123542	6.8 MEDIUM	OpenAM before 16.1.4 PKCE Bypass in OAuth 2.0 Device Authorization Flow
CVE-2026-123538	6.6 MEDIUM	OpenAM before 16.1.4 SAML 1.x Signature Verification Issuer Impersonation
CVE-2026-123553	6.5 MEDIUM	OpenAM before 16.1.4 Default Credentials in Built-in Accounts Allow Unauthenticated Login
CVE-2026-123546	6.1 MEDIUM	OpenAM before 16.1.4 Open Redirect and XSS via goto and gotoOnFail
CVE-2026-123537	5.0 MEDIUM	OpenAM before 16.1.4 SSRF via UMA Scope Description URLs
CVE-2026-123539	4.8 MEDIUM	OpenAM before 16.1.4 Stored XSS via OAuth 2.0 Consent Page Display Name
CVE-2026-123541	4.7 MEDIUM	OpenAM before 16.1.4 Open Redirect via SAML 1.x Trusted-Partner Matching
CVE-2026-123548	4.7 MEDIUM	OpenAM before 16.1.4 Open Redirect via WS-Federation and SAML v2.0 Pages
CVE-2026-123547	4.7 MEDIUM	OpenAM before 16.1.4 Open Redirect via SAML v2.0 RelayState
CVE-2026-123536	4.1 MEDIUM	OpenAM before 16.1.4 SSRF via Federation Configuration Wizard Metadata URLs
CVE-2026-123540	2.0 LOW	OpenAM before 16.1.4 Incomplete Attribute Encoding in SAML 1.x Form POST

IV. Related Vulnerabilities

Same product: OpenAM

Same vendor: OpenIdentityPlatform

Same weakness: CWE-918