CVE-2026-44202 OpenIdentityPlatform CVE debrief

Who should care

Defenders responsible for OpenAM servers, particularly those with authenticated user access, should assess exposure and apply the patch to prevent potential data disclosure. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify exposure and apply the patch. Monitoring OpenAM server logs for suspicious outbound requests is recommended.

Why it matters

CVE-2026-44202 is a vulnerability in Open Access Management (OpenAM) that allows an authenticated user to register an arbitrary notification URL, potentially disclosing session-related notification data. Defenders should prioritize verifying exposure and applying the patch.

• Authenticated users can register arbitrary notification URLs, potentially disclosing session-related data.
• Outbound requests can be made from the OpenAM server to attacker-controlled destinations.
• Defenders should verify exposure and apply the patch to prevent potential data disclosure.
• Monitoring OpenAM server logs for suspicious outbound requests is recommended.

Technical summary

The /sessionservice addSessionListener operation in OpenAM allows an authenticated user to register an arbitrary notification URL without requiring an administrative or application client token. This causes the OpenAM server to make outbound requests and potentially disclose session-related notification data to an attacker-controlled destination. The vulnerability affects OpenAM servers with authenticated user access, allowing an attacker to make outbound requests and potentially disclose session-related data. Defenders should assess exposure and apply the patch to prevent potential data disclosure.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, as the vulnerability allows an authenticated user to make outbound requests and potentially disclose session-related data.

Recommended defensive actions

• Verify if the OpenAM server is exposed to authenticated users who could register arbitrary notification URLs.
• Check if the OpenAM server version is prior to 16.1.1 and apply the patch if necessary.
• Monitor OpenAM server logs for suspicious outbound requests.
• Restrict access to the /sessionservice addSessionListener operation to administrative or application client tokens only.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and fixed version. The vulnerability allows an authenticated user to register an arbitrary notification URL without requiring an administrative or application client token. This causes the OpenAM server to make outbound requests and potentially disclose session-related notification data to an attacker-controlled destination. The CVE record was published on 2026-09-15T10:17:03.350Z and has not been modified since then. The NVD and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.