Server-side Request Forgery (SSRF) Affecting nl.nl-portal:form package, versions [1.1.0,3.0.4)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-NLNLPORTAL-17732792
- published30 Jun 2026
- disclosed19 Jun 2026
- creditUnknown
Introduced: 19 Jun 2026
CVE-2026-55414 (opens in a new tab)How to fix?
Upgrade nl.nl-portal:form to version 3.0.4 or higher.
Overview
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the getFormDefinitionByObjectenApiUrl and getFormDefinitionById resolvers, which forward a privileged token to a caller-supplied URL on the configured Objecten-API host without proper authorization checks. An attacker can access sensitive backend resources by supplying a crafted URL to these resolvers, causing the backend to send requests with elevated privileges to attacker-controlled endpoints on the same host. This is only exploitable if the attacker can control or influence endpoints on the configured Objecten-API host.