Open Access Management (OpenAM) is an access management solution. (CVE-2026-44202)
Open Access Management (OpenAM) prior to version 16.1.1 contains a vulnerability in the /sessionservice addSessionListener operation. An authenticated user can register an arbitrary notification URL without needing administrative or application client tokens. This can cause the server to make outbound requests to attacker-controlled destinations, potentially exposing session-related notification data. The issue is fixed in OpenAM version 16.1.1.
AI Analysis
Technical Summary
CVE-2026-44202 affects OpenAM versions before 16.1.1. The vulnerability exists in the /sessionservice addSessionListener operation, which improperly allows authenticated users with low privileges to register arbitrary notification URLs without needing higher-level tokens. This causes the SessionRequestHandler to forward attacker-controlled URLs to the session listener service, leading the OpenAM server to make outbound requests that may leak session notification data to an attacker-controlled endpoint. The vulnerability is fixed in version 16.1.1.
Potential Impact
An authenticated user with limited privileges can exploit this vulnerability to cause the OpenAM server to send outbound requests to attacker-controlled URLs. This may result in the disclosure of session-related notification data to unauthorized parties. The impact is limited to information disclosure and requires authentication with low privileges.
Mitigation Recommendations
Upgrade OpenAM to version 16.1.1 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated by the vendor advisory.
Open Access Management (OpenAM) is an access management solution. (CVE-2026-44202)
Description
Open Access Management (OpenAM) prior to version 16.1.1 contains a vulnerability in the /sessionservice addSessionListener operation. An authenticated user can register an arbitrary notification URL without needing administrative or application client tokens. This can cause the server to make outbound requests to attacker-controlled destinations, potentially exposing session-related notification data. The issue is fixed in OpenAM version 16.1.1.
CVSS v4.0
Affected software
pkg:deb/ubuntu/openam?arch=source&distro=xenialRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-44202 affects OpenAM versions before 16.1.1. The vulnerability exists in the /sessionservice addSessionListener operation, which improperly allows authenticated users with low privileges to register arbitrary notification URLs without needing higher-level tokens. This causes the SessionRequestHandler to forward attacker-controlled URLs to the session listener service, leading the OpenAM server to make outbound requests that may leak session notification data to an attacker-controlled endpoint. The vulnerability is fixed in version 16.1.1.
Potential Impact
An authenticated user with limited privileges can exploit this vulnerability to cause the OpenAM server to send outbound requests to attacker-controlled URLs. This may result in the disclosure of session-related notification data to unauthorized parties. The impact is limited to information disclosure and requires authentication with low privileges.
Mitigation Recommendations
Upgrade OpenAM to version 16.1.1 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-44202
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:16.04:LTS"]
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab4be6bf7a7c54106f0d42b
Added to database: 09/24/2026, 06:08:43 UTC
Last enriched: 09/24/2026, 06:52:47 UTC
Last updated: 09/24/2026, 06:52:48 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.