5.4
MediumCVSS 3.1 · from VulnCheck
CVE-2026-105122
OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri
OpenAM · Server-side request forgery · CWE-918AffectedOpenAM
FixUpdate to 16.1.3 or newer
PublishedOct 3, 12:14 · VulnCheck
ScoredOct 3 · 5.4 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:05 UTC
What we know
No known exploitation. CISA KEV, checked 22:05 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
Description
OpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able to register or modify OAuth 2.0 clients to make OpenAM fetch internal resources via an unvalidated jwks_uri. Attackers can trigger unauthenticated fetches through client-authentication and ID-token validation to probe internal hosts, metadata endpoints or local files, or exhaust request threads for denial of service.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed inOpenAMbefore 16.1.316.1.3OpenAMNot affected16.1.3
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known