Pending AI Enrichment

This vulnerability was recently detected via the live feed and has not yet been processed by Precogs AI's context enrichment engine. The data below represents raw telemetric data.

RAW NVD TELEMETRY

CVE-2026-105122

CVSS Base Score
5.4 MEDIUM
Primary Weakness
CWE-918
Published Date
Oct 3, 2026
Data Source
NVD API

OpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able to register or modify OAuth 2.0 clients to make OpenAM fetch internal resources via an unvalidated jwks_uri. Attackers can trigger unauthenticated fetches through client-authentication and ID-token validation to probe internal hosts, metadata endpoints or local files, or exhaust request threads for denial of service.

Related Vulnerabilitiesvia CWE-918

CVE-2026-3543110 CRITICAL

Server-Side Request Forgery (SSRF) in Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to perform spoofing over a network

CWE-918
CVE-2026-322109.3 CRITICAL

Server-Side Request Forgery (SSRF) in Server-side request forgery (ssrf) in Microsoft Dynamics 365 (Online) allows an unauthorized attacker to perform spoofing over a network

CWE-918
CVE-2026-3218610 CRITICAL

Server-Side Request Forgery (SSRF) in Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to elevate privileges over a network

CWE-918
CVE-2026-48740 LOW

CVE-2026-4874: Server-Side Request Forgery in Keycloak

CWE-918
CVE-2026-45287.3 HIGH

A vulnerability was determined in trueleaf ApiFlow 0.

CWE-918
CVE-2024-562796.5 MEDIUM

Server-Side Request Forgery (SSRF) — Cloud metadata access

CWE-918

Is your system affected?

Precogs AI detects CVE-2026-105122 in compiled binaries, LLMs, and application layers — even without source code access.

Request Deep AnalysisBook a demo