Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.6

OpenAM can be tricked into fetching internal data

CVE-2026-105122 · published 1 month ago
Summary

Versions of OpenAM prior to 16.1.3 let people who can add or change login clients set a URL that OpenAM will contact without checking it. This can be used to make the server request hidden internal sites, files, or overload it, potentially exposing information or causing service disruption. Update OpenAM to version 16.1.3 or later, or restrict who can configure clients and validate URLs before use.

What to do
  • Update openidentityplatform openam to version 16.1.3 or later.
Affected software
VendorProductAffected versions
openidentityplatform openam < 16.1.3
Original advisory text
OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri
OpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able to register or modify OAuth 2.0 clients to make OpenAM fetch internal resources via an unvalidated jwks_uri. Attackers can trigger unauthenticated fetches through client-authentication and ID-token validation to probe internal hosts, metadata endpoints or local files, or exhaust request threads for denial of service.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.6 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published3 Oct 2026
Updated4 Nov 2026
First seen3 Oct 2026
Sources
CVE-2026-105122 · NVD
CVE-2026-105122 · OSV
GHSA-g7cv-hh35-cc7c · GHSA
CVE-2026-105122 · MITRE
Track software like this
Free during beta