CVE-2026-105122
Received Received - Intake

OpenAM SSRF via Unvalidated jwks_uri in OAuth 2.0

Publication date: 2026-10-03

Last updated on: 2026-10-03

Assigner: VulnCheck

Description
OpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able to register or modify OAuth 2.0 clients to make OpenAM fetch internal resources via an unvalidated jwks_uri. Attackers can trigger unauthenticated fetches through client-authentication and ID-token validation to probe internal hosts, metadata endpoints or local files, or exhaust request threads for denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-03
Last Modified
2026-10-03
Generated
2026-10-03
AI Q&A
2026-10-03
EPSS Evaluated
N/A
NVD
CVE-2026-105122
EUVD
EUVD-2026-92026

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
forgerock openam to 16.1.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-105122 is a Server-Side Request Forgery (SSRF) vulnerability in OpenAM versions before 16.1.3. Attackers who can register or modify OAuth 2.0 clients can manipulate the jwks_uri parameter to make OpenAM fetch internal resources without validation. This allows unauthenticated requests to probe internal hosts, access metadata endpoints, read local files, or cause denial of service by exhausting server resources.

Detection Guidance

To detect this SSRF vulnerability in OpenAM, monitor network traffic for unexpected outbound requests from the OpenAM server, particularly to internal IP ranges, metadata endpoints, or local files. Check OpenAM logs for failed client registrations or unusual jwks_uri values pointing to internal resources. Use network scanning tools to identify if OpenAM is making unauthorized requests to internal hosts or ports.

Impact Analysis

This vulnerability can allow attackers to access internal systems, steal sensitive data, or disrupt services by exhausting server resources. Organizations using vulnerable OpenAM versions risk unauthorized network reconnaissance, data breaches, and potential service outages.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations by enabling unauthorized access to personal or sensitive data, resulting in data breaches. Organizations may face legal penalties, reputational damage, and loss of trust if such incidents occur due to this flaw.

Mitigation Strategies

Immediately upgrade OpenAM to version 16.1.3 or later to apply the patch. As a temporary workaround, disable dynamic client registration, review existing client registrations for malicious jwks_uri values, and use inline jwks instead of jwks_uri. Apply egress filtering to block OpenAM from making outbound requests to internal networks or unauthorized endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105122. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart