This vulnerability (CVE-2026-103957) involves SSRF in the OAuth2 discovery process within AWS Loom prior to version 1.7.0. An authenticated remote attacker can exploit a crafted discovery document address when registering a tool server or remote agent configured for delegated authentication. This can lead to unauthorized access to another user's access token and force the application to issue requests to arbitrary internal network endpoints. The vulnerability is tracked under CWE-918 (SSRF) and CWE-201 (Information Exposure). AWS has published an advisory recommending upgrading to version 1.7.0 or later to remediate the issue.

An authenticated user with remote access can exploit this vulnerability to obtain access tokens belonging to other users in the deployment, potentially leading to unauthorized access to sensitive resources. Additionally, the attacker can cause the application to make requests to arbitrary internal network locations, which may expose internal services or data. The CVSS 3.1 base score is 6.2 (medium severity), reflecting network attack vector, low attack complexity, high privileges required, user interaction required, scope changed, high confidentiality impact, no integrity or availability impact.

A fix is available. Users should upgrade AWS Loom to version 1.7.0 or later as recommended by the official AWS security advisory (https://aws.amazon.com/security/security-bulletins/2026-124-aws/). Since this is a cloud service, AWS manages remediation for the cloud-hosted service. Users running self-hosted deployments must apply the upgrade to mitigate the vulnerability.