VulnSocial

CVE-2026-123537

LOWCVSS 5.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows parties registering UMA resource sets to trigger internal requests through unvalidated scope description URLs. Attackers can register resource sets with scope URLs pointing to internal hosts or cloud metadata endpoints, which OpenAM fetches when sending pending-request notification emails, enabling internal network probing.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-11-08: 111-08
Referenced assets1 URL
Full discourse1 post
  • NewNormal Security@NewScanTeam

    NewNormal Security turns CVEs since the previous batch into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 8 Nov 2026 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 📦 Unpatched single sign-on server — anonymous session-token theft, unsigned SAML assertions accepted (Open Identity Platform OpenAM CVE-2026-123551, CVE-2026-123550, CVE-2026-123538, CVE-2026-123553, CVE-2026-123543, CVE-2026-123542, CVE-2026-123545, CVE-2026-123552, CVE-2026-123537, CVE-2026-123536, CVE-2026-123541, CVE-2026-123546, CVE-2026-123547, CVE-2026-123548, CVE-2026-123539, CVE-2026-123540, CVE-2026-123544) 📦 Outdated WordPress booking plugin — anonymous password reset, account takeover (LatePoint CVE-2026-118066) 📦 Outdated Python web framework, now matched from its Server banner — static-file path traversal (Tornado CVE-2026-123534, CVE-2026-123535) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #SAML #CSO #REDTEAM

    000008
    7 followersView on X

Explore more

Back to dashboard