CVE-2026-105122: OpenAM OAuth 2.0 SSRF Vulnerability

CVE-2026-105122 Overview

CVE-2026-105122 is a server-side request forgery (SSRF) vulnerability in OpenAM versions prior to 16.1.3. The flaw resides in how OpenAM handles the jwks_uri parameter of OpenID Connect (OIDC) client registrations. Attackers with permission to register or modify OAuth 2.0 clients can supply an arbitrary jwks_uri value. OpenAM then fetches that URI during client authentication and ID-token validation without proper validation of the destination. The weakness is tracked under CWE-918.

Critical Impact
Attackers can coerce OpenAM into fetching internal hosts, cloud metadata endpoints, or local files, and can exhaust request threads to cause denial of service.

Affected Products

Open Identity Platform OpenAM versions prior to 16.1.3
OpenAM deployments exposing OAuth 2.0 / OIDC client registration or dynamic client management
OpenAM instances allowing modification of existing OIDC client jwks_uri values

Discovery Timeline

2026-10-03 - CVE-2026-105122 published to the National Vulnerability Database (NVD)
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105122

Vulnerability Analysis

OpenAM supports OpenID Connect clients that reference their JSON Web Key Set (JWKS) through a remote jwks_uri. During client authentication flows that use private_key_jwt and during ID-token signature validation, OpenAM retrieves the JWKS from the URI stored in the client configuration. The server performs this fetch without restricting the destination to an allowlist, blocking private address ranges, or validating the response content type.

An attacker who can register a new OAuth 2.0 client or modify an existing one controls the jwks_uri value. By pointing it at an internal resource, the attacker turns OpenAM into a request proxy. The fetch occurs server-side and inherits OpenAM's network position, which typically includes access to internal services and cloud metadata APIs.

Root Cause

The root cause is missing destination validation on the HTTP client used to retrieve OIDC JWKS documents. OpenAM accepts any URL supplied through the jwks_uri client attribute and issues an outbound request without filtering schemes, hostnames, or IP ranges. This is a textbook SSRF pattern described by CWE-918.

Attack Vector

An attacker with OAuth 2.0 client registration or modification rights sets jwks_uri to a target such as http://169.254.169.254/latest/meta-data/ or http://localhost:8080/admin. The attacker then triggers a client-authentication or token-validation flow that forces OpenAM to fetch the URI. Repeated requests to slow or non-responsive endpoints can exhaust the server's HTTP client thread pool and produce a denial-of-service condition. Fetch results may leak through error responses or timing differences, allowing probing of internal infrastructure. See the GitHub Security Advisory and VulnCheck SSRF Advisory for additional technical detail.

Detection Methods for CVE-2026-105122

Indicators of Compromise

Outbound HTTP requests from the OpenAM host to RFC1918 addresses, 127.0.0.1, or 169.254.169.254 that correlate with OIDC client authentication events.
OAuth 2.0 client records whose jwks_uri field points to internal hostnames, loopback addresses, or file:// schemes.
Spikes in failed JWKS retrieval errors in OpenAM logs tied to specific client identifiers.
OIDC token validation failures caused by non-JSON or empty responses from a configured jwks_uri.

Detection Strategies

Audit all OAuth 2.0 and OIDC client configurations for jwks_uri values that resolve to internal network ranges or cloud metadata endpoints.
Correlate OpenAM application logs with egress firewall logs to identify unexpected outbound destinations from the identity server.
Alert on creation or modification of OIDC clients by non-administrative accounts.

Monitoring Recommendations

Forward OpenAM access, audit, and OIDC flow logs to a centralized log platform for retention and query.
Monitor the OpenAM host's egress traffic for connections to metadata services and other sensitive internal endpoints.
Track client-registration API calls (/oauth2/register and administrative endpoints) and flag unusual request volume.

How to Mitigate CVE-2026-105122

Immediate Actions Required

Upgrade OpenAM to version 16.1.3 or later across all nodes in the cluster.
Review every registered OAuth 2.0 / OIDC client and remove or correct any jwks_uri referencing internal, loopback, or metadata addresses.
Restrict OAuth 2.0 client registration privileges to a minimum set of trusted administrators.
Disable dynamic client registration (/oauth2/register) if the deployment does not require it.

Patch Information

Open Identity Platform addresses the vulnerability in OpenAM 16.1.3. Refer to the GitHub Security Advisory GHSA-g7cv-hh35-cc7c for release notes and remediation details. Apply the upgrade in a staging environment first, then roll it out to production OpenAM instances.

Workarounds

Deploy an egress proxy or firewall rule set that blocks OpenAM from reaching private IP ranges, loopback, and cloud metadata endpoints (169.254.169.254, fd00:ec2::254).
Enforce an allowlist of permitted jwks_uri hostnames at the network perimeter.
Temporarily disable OIDC client authentication methods that rely on jwks_uri retrieval, such as private_key_jwt, until patching is complete.
Require administrative approval for any change to a client's jwks_uri attribute.

bash

# Example egress restriction using iptables on the OpenAM host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8   -p tcp --dport 1:65535 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8    -p tcp -m owner --uid-owner openam -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -p tcp -m owner --uid-owner openam -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp -m owner --uid-owner openam -j REJECT