To remediate this issue, users should upgrade to version 1.7.0 or later.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| AWS | loom | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Fri, 02 Oct 2026 19:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Fri, 02 Oct 2026 19:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted discovery document address supplied when registering a tool server or remote agent configured for delegated authentication. To remediate this issue, users should upgrade to version 1.7.0 or later. | |
| Title | Server-side request forgery in the OAuth2 discovery handling in Loom for AWS | |
| Weaknesses | CWE-201 CWE-918 |
|
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: AMZN
Published:
Updated: 2026-10-02T19:16:02.590Z
Reserved: 2026-10-01T14:59:36.668Z
Link: CVE-2026-103957
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-02T19:16:39.893
Modified: 2026-10-02T20:17:00.390
Link: CVE-2026-103957
Redhat
No data.
OpenCVE Enrichment
No data.