CVE-2026-107597

CVE-2026-107597 · jwks_uri from the OIDC discovery document is fetched without checking its origin or scheme

This page contains facts from public vulnerability sources. Check the original advisory before updating.

PIA's token verification (`verify_token` in `pia/oidc.py`) fetches the OIDC discovery document of an allowlisted issuer and then follows the `jwks_uri` contained in that response without parsing it as a URL, comparing it against the approved issuer's origin, or requiring HTTPS — the only check is that the field is non-empty (`pia/oidc.py:42-52`). An approved identity provider — and every registered per-project Jenkins instance under `https://ci.eclipse.org/<project>/oidc` is a separate such party (`pia/models.py`) — can therefore direct PIA to issue a GET request to an arbitrary host and port, including over plaintext `http`, from PIA's own network position. The fetch happens before any signature is verified, as a side effect of an unauthenticated `POST /v1/upload/sbom` request that is ultimately rejected with 401.

CVSS 5.1 · Medium · EPSS 0.4%

Published

2026-10-20T10:06:37.127Z

Updated

2026-10-20T15:36:50.392Z

Check your server →