CVE intelligence

CVE-2026-103957

Vulnerability intelligence

Published Oct 2, 2026Sources checked Oct 2, 2026

6.2MEDIUMCVSS out of 10

What this means

Review the available evidence

CVE-2026-103957 and is rated Medium severity with a CVSS score of 6.2. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

AWS Security Bulletins guidance

We recommend upgrading to the latest version (1.7.0) and ensuring any forked or derivative code is patched to incorporate the new fixes.

CISA KEVNot listedBased on the latest collected catalog

EPSSUnavailableNo current score collected

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-103957?

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted discovery document address supplied when registering a tool server or remote agent configured for delegated authentication. To remediate this issue, users should upgrade to version 1.7.0 or later.