CVE-2026-55414: 
Java vulnerability analysis and mitigation

CVE-2026-55414 is a constrained Server-Side Request Forgery (SSRF) combined with missing authorization in the NL Portal Backend Libraries (nl.nl-portal:form). The public GraphQL resolvers getFormDefinitionByObjectenApiUrl(url) and the deprecated getFormDefinitionById(id) accept caller-supplied URLs and forward outbound requests carrying the privileged Authorization: Token <objecten-api-token> header without requiring authentication. The vulnerability was introduced on 2023-08-12 (commit b2f87ca) and first shipped in version 1.1.0.RELEASE (2023-10-31); all releases from 1.1.x through 3.0.x and 3.1.0 are affected, with a fix available in 3.0.4.RELEASE. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Security Advisory).

The root cause is a combination of CWE-862 (Missing Authorization) and CWE-918 (Server-Side Request Forgery). The /graphql endpoint is configured as permitAll() in OauthSecurityAutoConfiguration.kt, and the vulnerable resolvers in FormDefinitionQuery.kt lack a CommonGroundAuthentication parameter, meaning no authentication check is enforced. The caller-supplied URL flows unvalidated through ObjectsApiFormDefinitionService.kt into ObjectenApiService.getObjectByUrl(url), where the only guard is a host-equality check (URI.create(url).host == objectsApiClientConfig.url.host) — with no scheme, port, or path validation — before ObjectsApiClient.getObjectByUrl(url) attaches the Authorization: Token header via webClientWithoutBaseUrl(). The SSRF is constrained to the configured Objecten-API host; URL-parser bypass payloads (userinfo @, encoded characters, backslash, IPv6, IDN) were tested and found to be rejected or kept on the configured host, limiting cross-host token exfiltration in standard deployments (GitHub Advisory).

An unauthenticated attacker can cause the backend to issue outbound HTTP requests to attacker-influenced paths and ports on the configured Objecten-API host, with the privileged API token attached. In standard deployments, the token cannot be exfiltrated to an external host due to the host-equality guard, limiting the confidentiality impact to low. However, if the Objecten-API host shares infrastructure with an attacker-controllable endpoint (e.g., a different port or path), the privileged token could be captured, potentially enabling unauthorized access to sensitive government citizen data managed by the Objecten API. Arbitrary PII object reads are additionally constrained by typed deserialization — responses not matching the ObjectsApiObject form-definition schema return a DecodingException and no data (GitHub Advisory, Security Advisory).

A lab proof-of-concept was confirmed by the reporter (Ray Sabee, @raysabee, whitehatsecurity.nl) against the project's own WebFlux security stack — no production system was accessed. Exploitation requires only an unauthenticated HTTP POST to the /graphql endpoint with a crafted getFormDefinitionByObjectenApiUrl query; no privileges or user interaction are needed. There is no evidence of in-the-wild exploitation, no known exploit kits, and no CISA KEV catalog listing as of the advisory date. The CVE status is listed as "Reserved" and no EPSS score is currently published (GitHub Advisory).

1. Reconnaissance: Identify NL Portal Backend Library deployments (versions 1.1.0 through < 3.0.4) by locating exposed /graphql endpoints, which are publicly accessible by design. The GraphQL schema is open source, so query names are known without introspection.
2. Craft the malicious GraphQL query: Construct an unauthenticated HTTP POST request to /graphql with the following body targeting a specific path/port on the configured Objecten-API host:

{"query": "{ getFormDefinitionByObjectenApiUrl(url: \"http://<objecten-api-host>:<port>/attacker-chosen-path\") { ... } }"}

3. Trigger the SSRF: Submit the request without any authentication headers. The backend's FormDefinitionQuery.kt resolver accepts the URL and passes it through ObjectsApiFormDefinitionService to ObjectenApiService.getObjectByUrl(url), which validates only the host portion.
4. Capture the privileged token: If the attacker controls a listener on the configured Objecten-API host (e.g., a different port or path), the outbound request from the backend will arrive carrying Authorization: Token <objecten-api-token>, which can then be captured and reused for direct Objecten-API access.
5. Exploit captured token: Use the captured token to make direct authenticated requests to the Objecten-API, potentially reading or enumerating objects beyond what the form resolver would return (GitHub Advisory, Security Advisory).

• Network: Unexpected outbound HTTP requests from the NL Portal backend to non-standard ports or unusual paths on the configured Objecten-API host; repeated requests to the Objecten-API host with varying path/port combinations originating from the backend service.
• Logs: Application logs showing POST /graphql requests from unauthenticated clients containing getFormDefinitionByObjectenApiUrl or getFormDefinitionById queries with unusual or externally-supplied URL values; DecodingException errors in backend logs indicating failed deserialization of non-form-definition objects.
• Application: GraphQL access logs recording calls to getFormDefinitionByObjectenApiUrl or getFormDefinitionById from IP addresses not associated with known frontend clients, especially with URL arguments pointing to non-standard paths or ports on the Objecten-API host (GitHub Advisory).

The fix is available in 3.0.4.RELEASE (commit 39ad80f, PR #700). The patch removes the vulnerable unauthenticated resolvers getFormDefinitionByObjectenApiUrl and getFormDefinitionById from FormDefinitionQuery and the GraphQL schema entirely, replaces URL-based fetching with UUID-based fetching via /api/v2/objects/{uuid} (eliminating caller-supplied URLs), and introduces a new authenticated getFormDefinitionByTaskId(taskId) query in nl.nl-portal:taak that requires CommonGroundAuthentication. Backend operators must upgrade nl.nl-portal:* to 3.0.4 or later, and frontend deployments must upgrade nl-portal-frontend-libraries to v3.0.3 or later, as the removed queries constitute a breaking change. No configuration-based workaround is available for unpatched versions; network-level controls restricting access to /graphql from untrusted sources can reduce exposure but are not a substitute for patching (GitHub Advisory, Fix PR).

The vulnerability was reported responsibly by independent security researcher Ray Sabee (whitehatsecurity.nl, GitHub @raysabee) and confirmed in a lab environment without accessing any production system. The advisory was published by the project maintainer (theo-ritense) on June 18, 2026, and the fix was merged by anna-ritense on June 17, 2026 via PR #700. No broader media coverage or significant social media discussion has been identified beyond the GitHub advisory and associated pull request (GitHub Advisory, Fix PR).