CVE-2026-107597
Received Received - Intake

Token Verification Bypass in PIA via JWKS URI Spoofing

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Eclipse Foundation

Description
PIA's token verification (`verify_token` in `pia/oidc.py`) fetches the OIDC discovery document of an allowlisted issuer and then follows the `jwks_uri` contained in that response without parsing it as a URL, comparing it against the approved issuer's origin, or requiring HTTPS — the only check is that the field is non-empty (`pia/oidc.py:42-52`). An approved identity provider — and every registered per-project Jenkins instance under `https://ci.eclipse.org/<project>/oidc` is a separate such party (`pia/models.py`) — can therefore direct PIA to issue a GET request to an arbitrary host and port, including over plaintext `http`, from PIA's own network position. The fetch happens before any signature is verified, as a side effect of an unauthenticated `POST /v1/upload/sbom` request that is ultimately rejected with 401.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-107597
EUVD
EUVD-2026-104909

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Eclipse Foundation Eclipse CSI - PIA 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a blind Server-Side Request Forgery (SSRF) vulnerability in PIA's token verification process. When PIA verifies a token, it fetches an OIDC discovery document from an allowlisted issuer and blindly follows the jwks_uri field without validating its origin or scheme. This allows an attacker who controls an allowlisted issuer to make PIA send HTTP requests to arbitrary internal or external hosts and ports, including plaintext HTTP connections, from PIA's network position.

Detection Guidance

To detect this vulnerability, monitor network traffic for outbound requests from PIA to unexpected hosts or ports. Check logs for GET requests to arbitrary URLs during token verification. Inspect `jwks_uri` values in OIDC discovery documents for allowlisted issuers for non-HTTPS or internal endpoints.

Impact Analysis

An attacker could exploit this to interact with internal services or systems reachable from PIA's network, potentially leading to data exfiltration, service disruption, or further attacks like downgrading HTTPS to HTTP to manipulate JWK sets. The impact depends on PIA's network configuration and the services it can access.

Compliance Impact

This vulnerability could lead to unauthorized network access or data exposure, which may violate compliance requirements for data protection and network security such as GDPR's integrity and confidentiality principles or HIPAA's access controls and integrity requirements. The specific impact depends on the data processed by PIA and the affected systems.

Mitigation Strategies

Upgrade PIA to version 0.9.0 or later to apply scheme and origin checks for `jwks_uri`. Ensure all allowlisted IdPs enforce HTTPS and validate `jwks_uri` origins. Restrict network access to PIA to limit potential SSRF impact.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107597. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart