CVE-2026-105122: OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri
OpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able to register or modify OAuth 2.0 clients to make OpenAM fetch internal resources via an unvalidated jwksuri. Attackers can trigger unauthenticated fetches through client-authentication and ID-token validation to probe internal hosts, metadata endpoints or local files, or exhaust request threads for denial of service.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to register or modify an OAuth 2.0 client and set its OpenID Connect jwks_uri. The affected behavior can then be triggered through client authentication or ID-token validation.
What can an attacker reach through the vulnerable server-side request?
The issue can be used to make OpenAM fetch internal resources, including internal hosts, metadata endpoints, or local files. It can also be used to exhaust request threads and cause denial of service.
Which deployments are affected?
Open Identity Platform Community OpenAM versions before 16.1.3 are affected. The provided information does not establish whether a default configuration permits client registration or client modification.