eclipse_csi_-_pia vulnerabilities
CVEs whose affected-version data names the eclipse_csi_-_pia package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-108062Medium· 6.9Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop
Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service.
▾ SunlitEclipse Foundation · Eclipse CSI - PIAvia CVEORG
CVE-2026-107597Medium· 5.1jwks_uri from the OIDC discovery document is fetched without checking its origin or scheme
PIA's token verification (`verify_token` in `pia/oidc.py`) fetches the OIDC discovery document of an allowlisted issuer and then follows the `jwks_uri` contained in that response without parsing it as a URL, comparing it against the appr…
▾ SunlitEclipse Foundation · Eclipse CSI - PIAvia CVEORG