CVE-2026-105122: OpenAM server-side request forgery in OAuth 2.0 client jwks_uri

CVE-2026-105122 · Severity: medium · CVSS 5.4 · Published 2026-10-03

OpenAM is an identity and access management platform that handles user authentication and OAuth 2.0 client registration. An attacker with the ability to register or modify OAuth clients can exploit a flaw in how OpenAM fetches cryptographic keys from a jwks_uri parameter, allowing them to probe internal networks, cloud metadata endpoints, or local files, or to conduct denial-of-service attacks by causing the server to hang on slow responses.

Technologies: OpenIdentityPlatform OpenAM. Vendors: OpenIdentityPlatform.

Quick answers

Is CVE-2026-105122 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-105122 being exploited in the wild.
How severe is CVE-2026-105122?
Medium severity, with a CVSS score of 5.4, published 3 October 2026.
Which products and versions are affected?
OpenIdentityPlatform OpenAM before 16.1.3.
Is there a fix for CVE-2026-105122?
Yes: fixed in 16.1.3. Until then: Disable Allow Open Dynamic Client Registration in the OAuth2 Provider service and restrict access to the /oauth2/connect/register endpoint at the reverse proxy or firewall. Review existing OAuth 2.0 client registrations for unexpected jwks_uri values and remove or correct them; for clients with static keys, use inline jwks client metadata instead of jwks_uri. Apply default-deny outbound egress filtering on OpenAM hosts, explicitly denying connections to internal networks and cloud metadata endpoints (169.254.169.254, 100.100.100.200). Monitor for client registrations with unexpected jwks_uri targets and bursts of failed client authentication. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105122 attacked?
It is attacked over the network.
Am I affected by CVE-2026-105122?
Check whether you run OpenIdentityPlatform OpenAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 16.1.3

Disable Allow Open Dynamic Client Registration in the OAuth2 Provider service and restrict access to the /oauth2/connect/register endpoint at the reverse proxy or firewall. Review existing OAuth 2.0 client registrations for unexpected jwks_uri values and remove or correct them; for clients with static keys, use inline jwks client metadata instead of jwks_uri. Apply default-deny outbound egress filtering on OpenAM hosts, explicitly denying connections to internal networks and cloud metadata endpoints (169.254.169.254, 100.100.100.200). Monitor for client registrations with unexpected jwks_uri targets and bursts of failed client authentication.

Technical details

The vulnerability is a server-side request forgery (SSRF) in the OAuth 2.0 / OpenID Connect jwks_uri handling. The affected component accepts any URL scheme and fetches from any address (including loopback, private, and special-purpose ranges) without validation, follows redirects without re-checking the destination, and does not bound the size or duration of fetches. Attackers who can register clients or modify existing OAuth 2.0 clients trigger these fetches unauthenticated through client-authentication and ID-token validation paths, enabling both information disclosure via blind probing and denial of service through resource exhaustion.

Affected products

  • OpenIdentityPlatform OpenAM before 16.1.3

Timeline

  • 2026-09-18: disclosed: GitHub Security Advisory published
  • 2026-10-03: advisory: Public disclosure and NVD listing

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.