CVE-2026-105122

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3

Description A server-side request forgery (SSRF) issue exists where attackers with permissions to register or modify OAuth 2.0 clients can force the server to fetch internal resources. This occurs through the use of an unvalidated jwks uri variable. By leveraging client-authentication and ID-token validation, unauthenticated fetches can be triggered to probe internal hosts, metadata endpoints, or local files, or to cause a denial of service by exhausting request threads.

Recommendations Update to version 16.1.3 or later.