CVE-2026-44202: OpenAM SSRF Vulnerability

CVE-2026-44202 Overview

CVE-2026-44202 is a Server-Side Request Forgery (SSRF) vulnerability in Open Identity Platform's Open Access Management (OpenAM) prior to version 16.1.1. The flaw exists in the /sessionserviceaddSessionListener operation, which accepts an arbitrary notification URL from any authenticated user without requiring an administrative or application client token. The SessionRequestHandler forwards the attacker-controlled destination to the session listener service. The OpenAM server then issues outbound HTTP requests to that destination, potentially disclosing session-related notification data. The issue is classified under CWE-918: Server-Side Request Forgery and is fixed in version 16.1.1.

Critical Impact
An authenticated low-privilege user can coerce the OpenAM server into making outbound HTTP requests to arbitrary destinations and leak session notification data.

Affected Products

Open Identity Platform OpenAM versions prior to 16.1.1
OpenAM deployments exposing the /sessionservice endpoint
OpenAM SessionRequestHandler and session listener subsystem

Discovery Timeline

2026-09-15 - CVE-2026-44202 published to NVD
2026-09-15 - Last updated in NVD database
Version 16.1.1 - Open Identity Platform releases patched OpenAM release (GitHub Release 16.1.1)

Technical Details for CVE-2026-44202

Vulnerability Analysis

OpenAM exposes a session service that supports listener registration for session-related events. The addSessionListener operation on /sessionservice accepts a notification URL as a parameter. In vulnerable releases, this operation does not verify that the caller holds an administrative or application client token. Any authenticated session token is sufficient to register a listener. Once registered, OpenAM sends outbound HTTP notifications carrying session-related data to the attacker-supplied endpoint. This satisfies the classic Server-Side Request Forgery pattern: an attacker controls the destination of server-issued requests and receives sensitive event data as a result.

Root Cause

The root cause is missing authorization enforcement in SessionRequestHandler for the addSessionListener operation. The handler passes the caller-supplied destination directly to the session listener service without checking the token's principal type. Agent and server tokens should have been required, but no such check existed. The upstream fix in commit a13a4b63ae0e0670c63cbcfa79586407408b3920 introduces an Agent/Server authorization requirement for addSessionListener, closing the trust gap.

Attack Vector

Exploitation requires network access to OpenAM and a valid user session token. The attacker calls the /sessionservice endpoint with an addSessionListener request that specifies a URL under their control. OpenAM then issues outbound HTTP requests to that URL whenever session events fire. The attacker collects the delivered notification payloads and can also use the primitive to probe internal network resources reachable from the OpenAM host.

java

// Patch context from openam-core/src/main/java/com/iplanet/dpro/session/Session.java
 * $Id: Session.java,v 1.25 2009/08/14 17:53:35 weisun2 Exp $
 *
 * Portions copyright 2010-2016 ForgeRock AS.
+ * Portions Copyrighted 2017-2026 3A Systems LLC
 */

package com.iplanet.dpro.session;

// Companion change in MonitoredOperations.java enforces
// Agent/Server authorization on addSessionListener.
// Source: https://github.com/OpenIdentityPlatform/OpenAM/commit/a13a4b63ae0e0670c63cbcfa79586407408b3920

Detection Methods for CVE-2026-44202

Indicators of Compromise

Unexpected outbound HTTP or HTTPS connections originating from the OpenAM server to external or unusual internal hosts.
OpenAM audit logs recording addSessionListener calls submitted with non-administrative session tokens.
Session notification payloads observed leaving the network to destinations not defined in operational runbooks.

Detection Strategies

Review OpenAM access and audit logs for /sessionservice requests invoking addSessionListener and correlate the calling principal against expected agent or server identities.
Inspect egress traffic from OpenAM hosts for HTTP callbacks that do not match known integration endpoints.
Alert on any session-service request whose notification URL parameter points to internal metadata services, loopback ranges, or unapproved external domains.

Monitoring Recommendations

Forward OpenAM application logs and web-server access logs to a centralized analytics platform for retention and query.
Baseline the set of legitimate destinations for session listener callbacks and alert on deviations.
Monitor OpenAM server outbound connections at the network layer to detect SSRF-style callbacks to attacker-controlled infrastructure.

How to Mitigate CVE-2026-44202

Immediate Actions Required

Upgrade OpenAM to version 16.1.1 or later, which enforces Agent/Server authorization on the addSessionListener operation.
Restrict network access to the /sessionservice endpoint so that only trusted clients can reach it.
Rotate any session-related secrets that may have been exposed if evidence of exploitation exists.

Patch Information

The fix is delivered in OpenAM 16.1.1. Refer to the GitHub Security Advisory GHSA-c556-q2mh-477v, the GitHub Release 16.1.1, and the upstream commit for full details. The patch adds an authorization requirement so that only Agent or Server principals may register session listeners.

Workarounds

Place a reverse proxy or web application firewall in front of OpenAM and block requests that invoke addSessionListener from non-administrative sources.
Enforce strict egress filtering from the OpenAM host, permitting outbound HTTP only to known integration endpoints.
Limit /sessionservice exposure to management networks until the upgrade to 16.1.1 is complete.

bash

# Example egress restriction using iptables to allow outbound HTTP
# only to a known session-listener consumer.
iptables -A OUTPUT -o eth0 -p tcp --dport 443 \
    -d listener.internal.example.com -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -o eth0 -p tcp --dport 443 -j DROP