CVE-2026-44202 in OpenAM
Summary
by MITRE • 09/15/2026
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the /sessionservice addSessionListener operation allows an authenticated user to register an arbitrary notification URL without requiring an administrative or application client token. SessionRequestHandler passes the attacker-controlled destination to the session listener service, causing the OpenAM server to make outbound requests and potentially disclose session-related notification data to an attacker-controlled destination. This issue is fixed in version 16.1.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified within Oracle Access Management, formerly known as OpenAM, represents a critical flaw in the authentication and session management subsystems that allows for unauthorized information disclosure through server-side request forgery mechanisms. Specifically, this issue resides in the /sessionservice addSessionListener operation available in versions prior to 16.1.1. The core technical deficiency lies in the insufficient validation of user-supplied input during the registration process for session notifications. While the system correctly requires authentication for general access, it fails to enforce strict authorization checks or output encoding when processing the destination URL provided by an authenticated but non-privileged user. This architectural oversight permits any validly authenticated account to inject arbitrary Uniform Resource Locators into the session listener service without possessing administrative privileges or specific application client tokens that would normally be required for such sensitive configuration changes.
From a technical perspective, the SessionRequestHandler component acts as the intermediary between the user request and the underlying session management logic. When an attacker submits a crafted HTTP request to addSessionListener with a maliciously controlled destination URL, the handler accepts this input without verifying its legitimacy or safety. Consequently, the OpenAM server initiates outbound network connections directed at the attacker-controlled endpoint. This behavior effectively transforms the vulnerable application into a proxy for data exfiltration. The session listener service is designed to transmit real-time notifications regarding user sessions, which can include sensitive identifiers such as session tokens, unique session IDs, and potentially other contextual metadata associated with active authentication states. By directing these outbound requests to an external server under the attacker's control, the vulnerability facilitates a direct leakage of critical security credentials that are essential for maintaining the integrity of the identity management infrastructure.
The operational impact of this vulnerability is severe due to its potential to compromise ongoing user sessions and facilitate further attacks within the enterprise environment. An adversary who successfully exploits this flaw can harvest session tokens from active users, which may allow them to perform unauthorized actions under those users' identities without needing valid credentials or multi-factor authentication factors. This capability undermines the fundamental trust model of the access management solution. Furthermore, because the vulnerability relies on outbound requests initiated by the server itself, it bypasses many traditional client-side security controls and browser-based restrictions that might otherwise mitigate similar attacks like Cross-Site Request Forgery. The ability to exfiltrate session data enables attackers to conduct account takeover operations, escalate privileges if combined with other vulnerabilities, or map out the internal network topology based on which services respond to the forged requests.
This vulnerability aligns closely with CWE-209, which describes the generation of an error message that includes sensitive information useful for an attacker, and more specifically CWE-351, where insufficient control over dynamic code execution leads to unintended behavior in this context via injected destinations. In terms of offensive security frameworks, it maps directly to MITRE ATT&CK technique T1048, Exfiltration Over Alternative Protocol, as the data is exfiltrated using HTTP/S requests initiated by a trusted internal service rather than direct user interaction or standard web traffic patterns typically monitored by perimeter defenses. The attack vector also shares characteristics with Server-Side Request Forgery (SSRF), specifically categorized under T1589 in some contexts regarding credential harvesting, although the primary mechanism here is the abuse of legitimate administrative functions for data theft.
Mitigation strategies must prioritize immediate patching and compensating controls to address this risk effectively. The definitive resolution involves upgrading Oracle Access Management to version 16.1.1 or later, where the vendor has implemented stricter validation logic to ensure that only authorized entities can register session listeners with valid destinations. For environments unable to upgrade immediately due to operational constraints, network-level mitigations are essential. Implementing strict egress filtering rules on firewalls and proxy servers can restrict outbound connections from the OpenAM server IP address to a predefined whitelist of trusted domains, thereby preventing communication with attacker-controlled endpoints. Additionally, deploying Web Application Firewalls that inspect outgoing traffic for anomalies or known malicious signatures associated with session token formats may provide an additional layer of detection. It is also advisable to review and harden access control policies within the OpenAM console to ensure that sensitive administrative operations are restricted to a minimal set of highly privileged accounts, reducing the attack surface available to lower-privileged authenticated users who might attempt exploitation.