AWS Loom CVE-2026-103957

The attacker must be an authenticated user of the deployment with sufficient privileges to register a tool server or remote agent configured for delegated authentication (PR:H), and must supply a crafted OAuth2 discovery document address that the backend will fetch. The token-disclosure outcome additionally requires passive user interaction (UI:P) from a victim user whose access token is obtained. Exploitation is limited to deployments actually using the OAuth2/OIDC delegated-authentication discovery feature; the vulnerable code path was present only before version 1.7.0, which added a deployment-trusted-issuer check plus an IP-validated, DNS-pinned fetcher. These privilege and interaction prerequisites meaningfully constrain exploitation versus a fully unauthenticated SSRF.

This is a credible, above-average-priority issue but not an emergency. The CVSS 4.0 base score of 8.2 (High) reflects a network attack vector (AV:N), low complexity (AC:L), no additional attack requirements (AT:N), high confidentiality impact on both the vulnerable system and a subsequent system (VC:H/SC:H), and - importantly - high privileges required (PR:H) plus passive user interaction (UI:P). The dual high-confidentiality rating is the real driver: SSRF (CWE-918) here both discloses another user's OAuth2 access token and lets the attacker pivot requests into the internal network, which is why the subsequent-system confidentiality is elevated. Tempering signals: PR:H means the attacker must already be an authenticated, reasonably privileged user able to register a tool server or remote agent, and UI:P means a victim action is needed for the token-theft path - so this is not a pre-auth internet worm. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active or at-scale exploitation. The vendor (AMZN) self-reported it and shipped a fix, which is consistent with a responsibly-disclosed internal finding rather than an in-the-wild attack. Net: real and worth prompt patching for anyone running Loom, but the privilege and interaction requirements plus absence of exploitation evidence keep it below drop-everything urgency.

An authenticated, privileged user of a Loom for AWS deployment registers a tool server or remote agent for delegated authentication and supplies a crafted OAuth2 discovery document address pointing at an attacker-controlled or internal endpoint. When the backend fetches that discovery document and performs the subsequent token exchange, it can be coerced into leaking another user's access token and into issuing requests to arbitrary internal network locations. No public exploit identified at time of analysis; the token-disclosure path additionally depends on passive victim interaction (UI:P).