Read the docs
TI-2026-67497 Aliases CVE-2026-105122GHSA-r8x8-66rr-q5w2

OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri

Priority LOW 24CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

OpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able to register or modify OAuth 2.0 clients to make OpenAM fetch internal resources via an unvalidated jwks_uri. Attackers can trigger unauthenticated fetches through client-authentication and ID-token validation to probe internal hosts, metadata endpoints or local files, or exhaust request threads for denial of service.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00232 14th percentileScored 2026-11-07
Fix Fixed OpenAM (OpenIdentityPlatform): 16.1.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenIdentityPlatformOpenAMbefore 16.1.316.1.3Patch availableCNA

Remediation

  • Fix · CNA OpenAM (OpenIdentityPlatform) Fixed in 16.1.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    OpenIdentityPlatform OpenAM 16.1.3

    9 records Highest priority Priority MEDIUM 1 MEDIUM, 8 LOW

    Other records, highest priority first

    • TI-2026-67490 OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC InterfacePriority MEDIUM 44
    • TI-2026-67494 OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid FlowsPriority LOW 35
    • TI-2026-67496 OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm ScopingPriority LOW 30
    Show all 9 records →

Timeline

  1. 2026-10-03 Threatist record created from CVE-2026-105122
  2. 2026-10-03 Alias added: GHSA-r8x8-66rr-q5w2
  3. 2026-10-05 CISA SSVC decision points changed

References

Advisory 1

  • TI-2025-20332 OpenDJ Denial of Service (Dos) using alias loop CVSS 4.0HIGH 8.7
  • TI-2026-25836 Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM CVSS 4.0CRITICAL 9.3
  • TI-2026-86693 Session token disclosure in OpenAM notification WebSocket CVSS 4.0CRITICAL 10.0
  • TI-2026-86692 Authentication bypass in OpenAM SAML login accepts unsigned assertions CVSS 4.0CRITICAL 9.3
  • TI-2026-86691 Privilege escalation in OpenAM via self-registration attribute bypass CVSS 4.0CRITICAL 9.3
  • TI-2026-86685 Unbounded Java deserialization in OpenAM enables denial of service CVSS 4.0HIGH 8.7
See all 54 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences