CVE-2026-103957

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS

State: Published
Severity: 8.2 High
Published: Oct 2, 2026
Updated: Oct 9, 2026
Reserved: Oct 1, 2026

Description

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted discovery document address supplied when registering a tool server or remote agent configured for delegated authentication.

To remediate this issue, users should upgrade to version 1.7.0 or later.

Scores

CVSS	Score	Vector	Source
4.0	8.2 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N	AMZN
3.1	6.2 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N	AMZN

Weaknesses

CWE-918 Server-side request forgery
CWE-201 Insertion of sensitive information into sent data

Affected Products

Product	Versions
loomAWS	before 1.7.0Affected

References

https://github.com/awslabs/loom/releases/tag/v1.7.0release-notespatch
https://aws.amazon.com/security/security-bulletins/2026-124-aws/vendor-advisory
https://github.com/awslabs/loom/security/advisories/GHSA-jcxf-gpf4-58hmthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.