{"schema":"vulnpedia.research/1","cve":"CVE-2026-103956","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://github.com/awslabs/loom/releases/tag/v1.6.1","tags":["release-notes","patch"],"source":"mitre","sourceId":"AMZN","modified":"2026-10-09T16:36:18.246Z","origins":[{"source":"mitre","sourceId":"AMZN","modified":"2026-10-09T16:36:18.246Z","url":"https://github.com/awslabs/loom/releases/tag/v1.6.1"},{"source":"nvd","sourceId":"CVE-2026-103956","modified":"2026-10-06T14:49:40.823","url":"https://github.com/awslabs/loom/releases/tag/v1.6.1"}]},{"url":"https://aws.amazon.com/security/security-bulletins/2026-124-aws/","tags":["vendor-advisory"],"source":"mitre","sourceId":"AMZN","modified":"2026-10-09T16:36:18.246Z","origins":[{"source":"mitre","sourceId":"AMZN","modified":"2026-10-09T16:36:18.246Z","url":"https://aws.amazon.com/security/security-bulletins/2026-124-aws/"},{"source":"nvd","sourceId":"CVE-2026-103956","modified":"2026-10-06T14:49:40.823","url":"https://aws.amazon.com/security/security-bulletins/2026-124-aws/"}]},{"url":"https://github.com/awslabs/loom/security/advisories/GHSA-vgmj-998f-r8mp","tags":["third-party-advisory"],"source":"mitre","sourceId":"AMZN","modified":"2026-10-09T16:36:18.246Z","origins":[{"source":"mitre","sourceId":"AMZN","modified":"2026-10-09T16:36:18.246Z","url":"https://github.com/awslabs/loom/security/advisories/GHSA-vgmj-998f-r8mp"},{"source":"nvd","sourceId":"CVE-2026-103956","modified":"2026-10-06T14:49:40.823","url":"https://github.com/awslabs/loom/security/advisories/GHSA-vgmj-998f-r8mp"}]},{"source":"euvd","sourceId":"EUVD-2026-91770","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-91770","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-91770","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-91770"}]}],"packages":[],"pocCandidates":[{"url":"https://github.com/abraxas/cve-2026-103956-loom-unauth","source":"poc-in-github","sourceId":"CVE-2026-103956","description":"CVE-2026-103956 - Loom for AWS - Critical - Auth bypass - unauthenticated super-admin when no IdP is configured","modified":"2026-10-14T13:21:25Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-103956","url":"https://github.com/abraxas/cve-2026-103956-loom-unauth"},{"source":"poc-in-github","sourceId":"CVE-2026-103956","modified":"2026-10-14T13:21:25Z","url":"https://github.com/abraxas/cve-2026-103956-loom-unauth"}],"tags":[]}],"cataloguedPoc":[],"vendorStatements":[]}