CVE-2026-107597Medium· 5.1▾ SunlitPIA's token verification (`verify_token` in `pia/oidc.py`) fetches the OIDC discovery document of an allowlisted issuer and then follows the `jwks_uri` contained in that response without parsing it as a URL, comparing it against the appr…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 28.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
PIA's token verification (verify_token in pia/oidc.py) fetches the OIDC discovery document of an allowlisted issuer and then follows the jwks_uri contained in that response without parsing it as a URL, comparing it against the approved issuer's origin, or requiring HTTPS — the only check is that the field is non-empty (pia/oidc.py:42-52). An approved identity provider — and every registered per-project Jenkins instance under https://ci.eclipse.org/<project>/oidc is a separate such party (pia/models.py) — can therefore direct PIA to issue a GET request to an arbitrary host and port, including over plaintext http, from PIA's own network position. The fetch happens before any signature is verified, as a side effect of an unauthenticated POST /v1/upload/sbom request that is ultimately rejected with 401.
eclipse_csi_-_pia <= 0.8.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-108062Medium· 6.9Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop
CVE-2026-18660High· 8.8In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.
CVE-2026-86671High· 8.4In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an attacker-controlled URL to `URLFetcher.fetch()`, which calls `new URL(url).openConnection()` with no scheme or host a…
CVE-2026-102722Medium· 6.9In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply
CVE-2026-86590Medium· 6.3In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint passes a caller-supplied URL directly to an outbound HTTP GET request with no host filtering
CVE-2026-91041High· 7.8FileX fault-tolerant log replay writes past the destination sector when mounting a crafted FAT image