# CVE-2026-105122: OpenAM server-side request forgery in OAuth 2.0 client jwks_uri

Source: https://junglewise.ai/threats/cve-2026-105122-openam-before-16-1-3-contains-a-server-side-request-forgery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-03. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-105122 · Severity: medium · CVSS 5.4 · Published 2026-10-03

OpenAM is an identity and access management platform that handles user authentication and OAuth 2.0 client registration. An attacker with the ability to register or modify OAuth clients can exploit a flaw in how OpenAM fetches cryptographic keys from a jwks_uri parameter, allowing them to probe internal networks, cloud metadata endpoints, or local files, or to conduct denial-of-service attacks by causing the server to hang on slow responses.

Technologies: [OpenIdentityPlatform OpenAM](https://junglewise.ai/threats/technologies/openidentityplatform-openam). Vendors: [OpenIdentityPlatform](https://junglewise.ai/threats/vendors/openidentityplatform).

## Quick answers

**Is CVE-2026-105122 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105122 being exploited in the wild.

**How severe is CVE-2026-105122?** Medium severity, with a CVSS score of 5.4, published 3 October 2026.

**Which products and versions are affected?** OpenIdentityPlatform OpenAM before 16.1.3.

**Is there a fix for CVE-2026-105122?** Yes: fixed in 16.1.3. Until then: Disable Allow Open Dynamic Client Registration in the OAuth2 Provider service and restrict access to the /oauth2/connect/register endpoint at the reverse proxy or firewall. Review existing OAuth 2.0 client registrations for unexpected jwks_uri values and remove or correct them; for clients with static keys, use inline jwks client metadata instead of jwks_uri. Apply default-deny outbound egress filtering on OpenAM hosts, explicitly denying connections to internal networks and cloud metadata endpoints (169.254.169.254, 100.100.100.200). Monitor for client registrations with unexpected jwks_uri targets and bursts of failed client authentication. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105122 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-105122?** Check whether you run OpenIdentityPlatform OpenAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 16.1.3

Disable Allow Open Dynamic Client Registration in the OAuth2 Provider service and restrict access to the /oauth2/connect/register endpoint at the reverse proxy or firewall. Review existing OAuth 2.0 client registrations for unexpected jwks_uri values and remove or correct them; for clients with static keys, use inline jwks client metadata instead of jwks_uri. Apply default-deny outbound egress filtering on OpenAM hosts, explicitly denying connections to internal networks and cloud metadata endpoints (169.254.169.254, 100.100.100.200). Monitor for client registrations with unexpected jwks_uri targets and bursts of failed client authentication.

## Technical details

The vulnerability is a server-side request forgery (SSRF) in the OAuth 2.0 / OpenID Connect jwks_uri handling. The affected component accepts any URL scheme and fetches from any address (including loopback, private, and special-purpose ranges) without validation, follows redirects without re-checking the destination, and does not bound the size or duration of fetches. Attackers who can register clients or modify existing OAuth 2.0 clients trigger these fetches unauthenticated through client-authentication and ID-token validation paths, enabling both information disclosure via blind probing and denial of service through resource exhaustion.

## Affected products

- OpenIdentityPlatform OpenAM before 16.1.3

## Timeline

- 2026-09-18: disclosed: GitHub Security Advisory published
- 2026-10-03: advisory: Public disclosure and NVD listing

## References

- [https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-g7cv-hh35-cc7c](https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-g7cv-hh35-cc7c)
- [https://www.vulncheck.com/advisories/openam-before-16.1.3-ssrf-via-openid-connect-client-jwks-uri](https://www.vulncheck.com/advisories/openam-before-16.1.3-ssrf-via-openid-connect-client-jwks-uri)

## Related threats

- [OpenIdentityPlatform OpenAM open redirect in WS-Federation and SAML pages](https://junglewise.ai/threats/cve-2026-123548-openidentityplatform-openam-before-16-1-4-contains-an-open)
- [OpenAM denial of service in Java deserialization](https://junglewise.ai/threats/cve-2026-123543-openam-before-16-1-4-contains-a-denial-of-service-vulnerability)
- [OpenAM open redirect in end-session endpoint via unverified id_token_hint](https://junglewise.ai/threats/cve-2026-105118-openam-before-16-1-3-contains-an-open-redirect-vulnerability)