CVE-2026-103956: AWS Loom Authentication Bypass

CVE-2026-103956 affected AWS Labs Loom for AWS before 1.6.1: with no identity provider configured, any network client could receive super-admin authority. Upgrade to 1.7.0 or later to cover this flaw and the related Loom fixes; 1.6.1 already closes this authentication bypass.^{[1], [5]}

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H^[7]

💡 Plain English Explainer (ELI5)

A building leaves its front desk empty, but the software treats every visitor as the head administrator. The fix makes the desk refuse entry unless an identity provider is configured; a local-development exception requires an explicit switch and a visitor connecting from the same machine.^{[1], [4]}

Core Concepts & Subsystem Terms

Identity provider (IdP): The configured system that authenticates Loom users. The vulnerable condition occurred when neither Cognito nor an external IdP was configured.^[1]
Control plane: The application API and administration layer that manages agent integrations, credentials, and role policies.^[1]
Fail closed: When the required identity service is missing, deny the request instead of granting a default privileged identity.^[4]

Framework mappings

CWE reference for the weakness described in this guide: CWE-306 CWE-1188

Step-by-Step Attack Flow

Step 1

No identity provider is configured

The affected pre-1.6.1 condition is specific: neither a Cognito user pool nor an external IdP is configured.^[1]

Step 2

The fallback creates a privileged user

The vulnerable get_current_user path silently assigned t-admin and g-admins-super, including to unauthenticated requests.^[4]

Step 3

The API grants control-plane authority

A reachable client could act as super-admin, register tool servers, read stored integration credentials, or rewrite IAM policies attached to managed agent roles. This is the vendor-described impact, not evidence that a deployment was compromised.^[1]

Step 4

The fix rejects by default

Version 1.6.1 requires explicit LOOM_ALLOW_UNAUTHENTICATED_LOCAL_DEV=true and a loopback client for the local-development exception; otherwise it returns HTTP 401. AWS recommends 1.7.0 or later for the three-bug bulletin.^{[1], [4], [2], [3]}

Loom release coverage matrix

Release range	CVE-2026-103956 authentication bypass	Other issues in AWS's October bulletin	Operator action
<1.6.1	Affected if neither Cognito nor an external IdP is configured; a network client could receive super-admin access.	`CVE-2026-103957` and `CVE-2026-103958` are separate issues, also fixed in 1.7.0.	Upgrade to 1.7.0 or later. Version 1.6.1 is only the minimum fix for this bypass.
1.6.1–<1.7.0	Fixed. With no IdP, requests fail with 401 unless local-development opt-in is enabled and the client is loopback.	AWS lists the two companion issues as fixed in 1.7.0.	Upgrade to 1.7.0 or later for the full bulletin.
1.7.0 or later	Fixed.	AWS identifies 1.7.0 as resolving all three bulletin issues.	Keep Loom and any fork on a supported release and verify the fixes are carried forward.

Root Cause Analysis

When neither Cognito nor an external identity provider was configured, the authentication dependency's fallback silently assigned t-admin and g-admins-super instead of rejecting the request. The API then treated that fallback as an authenticated identity, so any network client able to reach the backend could receive super-admin control-plane authority. The patch fails closed; its local-development exception requires explicit opt-in and a loopback client. The CVE record maps the issue to CWE-306 (missing authentication for a critical function) and CWE-1188 (insecure default initialization).^{[1], [4], [7]}

Source Code: Flaw vs. Secure Implementation

The vulnerable branch reflects the maintainer's description of get_current_user: with neither Cognito nor an external IdP, it silently granted t-admin / g-admins-super. The hardened version summarizes the merged upstream behavior, not a verbatim source excerpt: local bypass requires the explicit environment opt-in and a loopback client; all other requests fail with 401. FlawOpen deployment note: trust request.client only when proxy handling is configured so untrusted forwarded headers cannot assert loopback. Upgrade to 1.6.1 or later for this CVE and to 1.7.0 or later for the full October bulletin. No exploit request or credential access procedure is shown.^{[4], [1]}

UNPATCHED FLAW

# Simplified control flow reported in the affected get_current_user path
if not cognito_pool and not external_idp:
    return User(username="t-admin", groups=["g-admins-super"])
return await authenticate_with_configured_idp(token)

HARDENED SECURE PATCH

# Fail closed unless the local-development exception is explicit and loopback-only
if not cognito_pool and not external_idp:
    opted_in = os.getenv("LOOM_ALLOW_UNAUTHENTICATED_LOCAL_DEV") == "true"
    peer_is_local = request.client is not None and ipaddress.ip_address(
        request.client.host
    ).is_loopback
    if opted_in and peer_is_local:
        return local_development_user()
    raise HTTPException(status_code=401, detail="Identity provider is not configured")
return await authenticate_with_configured_idp(token)

Engineering & System Hardening Checklist

✓Upgrade Loom to 1.7.0 or later; 1.6.1 is the first release that fixes CVE-2026-103956, while 1.7.0 is the consolidated bulletin target.^{[1], [2], [3]}
✓Confirm Cognito or an external identity provider is configured before exposing the backend beyond loopback.^[1]
✓Keep LOOM_ALLOW_UNAUTHENTICATED_LOCAL_DEV unset in deployed environments; if used for local development, verify the accepted client is loopback and the service is not reachable through an untrusted proxy. FlawOpen deployment check: trust the loopback signal only after verifying proxy-header handling.^{[1], [4]}
✓FlawOpen analysis: After upgrading, review access and administrative changes for the affected period. AWS recommends rotating configured OAuth2 client secrets and revoking and reissuing access tokens that were active during the affected window. If container role credentials were accessed, rotate the IAM role session credentials and review CloudTrail for unintended use.^[1]
✓Treat CVE-2026-103957 and CVE-2026-103958 as distinct companion issues fixed in 1.7.0; restrict mcp:write and a2a:write to trusted administrators until upgraded.^{[1], [3]}

Sources

← AI Security Hub Directory →