CVE-2026-107597: jwks_uri from the OIDC discovery document is fetched without checking its origin or scheme
PIA's token verification (verifytoken in pia/oidc.py) fetches the OIDC discovery document of an allowlisted issuer and then follows the jwksuri contained in that response without parsing it as a URL, comparing it against the approved issuer's origin, or requiring HTTPS — the only check is that the field is non-empty (pia/oidc.py:42-52). An approved identity provider — and every registered per-project Jenkins instance under https://ci.eclipse.org/<project>/oidc is a separate such party (pia/models.py) — can therefore direct PIA to issue a GET request to an arbitrary host and port, including over plaintext http, from PIA's own network position. The fetch happens before any signature is verified, as a side effect of an unauthenticated POST /v1/upload/sbom request that is ultimately rejected with 401.
Affected Software
Event History
Frequently Asked Questions
Who can cause PIA to make the outbound request?
An approved identity provider can supply a discovery document whose non-empty jwks_uri points to an arbitrary host and port. Each registered per-project Jenkins instance under https://ci.eclipse.org/<project>/oidc is a separate approved party.
Is authentication required to trigger the request?
No. The request is triggered as a side effect of an unauthenticated POST to /v1/upload/sbom; the request is made before token signature verification, even though the upload request is ultimately rejected with HTTP 401.
Are non-HTTPS destinations in scope?
Yes. PIA does not require the jwks_uri to use HTTPS, so an approved issuer can direct it to a plaintext HTTP endpoint as well as arbitrary hosts and ports.
What validation is missing before PIA follows jwks_uri?
PIA only checks that jwks_uri is non-empty. It does not parse the value as a URL or compare its origin with the approved issuer's origin.