CVE-2026-105122 OpenIdentityPlatform CVE debrief

Who should care

Defenders responsible for OpenAM instances, especially those exposed to untrusted client registration or modification, should assess and prioritize remediation of this vulnerability.

Why it matters

Defenders should care about CVE-2026-105122 because it allows attackers to make OpenAM fetch internal resources, potentially leading to denial of service or unauthorized access. OpenAM instances exposed to untrusted client registration or modification are at risk. Remediation priority is high due to the potential for exploitation. Evidence is limited to CVE and NVD records, so further verification is required.

• Potential denial of service through request thread exhaustion
• Possible probing of internal hosts and metadata endpoints
• Risk of unauthorized internal resource access

Technical summary

The vulnerability allows attackers able to register or modify OAuth 2.0 clients to make OpenAM fetch internal resources via an unvalidated jwks_uri, potentially leading to denial of service or probing of internal hosts and metadata endpoints. This server-side request forgery vulnerability in OpenAM before 16.1.3 can be triggered through client-authentication and ID-token validation. Defenders should prioritize verifying and remediating this vulnerability in OpenAM instances, especially those exposed to untrusted client registration or modification.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in OpenAM instances, especially those exposed to untrusted client registration or modification.

Recommended defensive actions

• Verify OpenAM version and exposure to untrusted client registration or modification
• Restrict client registration and modification to trusted sources
• Validate and sanitize jwks_uri inputs from clients
• Monitor OpenAM logs for suspicious requests
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the server-side request forgery vulnerability in OpenAM before 16.1.3. Evidence is limited to CVE and NVD records, so further verification is required. Defenders should verify OpenAM version and exposure to untrusted client registration or modification. The vulnerability allows attackers to make OpenAM fetch internal resources via an unvalidated jwks_uri, potentially leading to denial of service or probing of internal hosts and metadata endpoints.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.