CVE-2026-18353
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its unverified `iss` claim against an issuer allowlist using Python's `urlparse` before performing OIDC discovery with `requests`. Because `urlparse` and `requests`/`urllib3` parse an authority string containing a backslash into different hostnames, an attacker can craft an issuer that passes the allowlist check yet drives `requests` to connect to an arbitrary attacker-chosen host.
Risk Assessment
An attacker can hijack the OIDC authentication process, potentially leading to unauthorized access to the system.
Recommendation
Update PIA to a version that includes a fix for this vulnerability.
Other vulnerabilities in PIA
See all- CVE-2026-107597Medium
PIA's token verification (verify_token in pia/oidc.py) fetches the OIDC discovery document of an allowlisted issuer and then follows the jwks_uri contained in that response without parsing it as a URL, comparing it against the approved issuer's origin, or requiring HTTPS. An approved identity provider can therefore direct PIA to issue a GET request to an arbitrary host and port, including over plaintext http, from PIA's own network position, before any signature is verified.
- CVE-2026-14336High
The vulnerability in PIA uses a bare string-prefix check for the OIDC issuer allowlist instead of validating the issuer as a properly host-bounded URL. An attacker can craft an issuer that passes the prefix check but points to a controlled server. This allows an unauthenticated caller of POST /v1/upload/sbom to force outbound HTTP(S) requests to an arbitrary host and accept a JWT signed with the attacker's key.
- CVE-2026-12616Medium
The vulnerability in the /v1/upload/sbom endpoint allows an unauthenticated attacker to inject fake log entries by manipulating the iss claim in a JWT token. Due to disabled JWT signature verification and literal newline rendering in the log format, the attacker can create entries indistinguishable from genuine successful authentication messages.
Original NVD description (English source)
PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim against an issuer allowlist using Python's `urlparse` before performing OIDC discovery with `requests`. Because `urlparse` and `requests`/`urllib3` parse an authority string containing a backslash (e.g. `https://attacker-host\@ci.eclipse.org/`) into *different* hostnames, an attacker can craft an issuer that passes the allowlist check yet drives `requests` — and subsequently `urllib.request.urlopen` for JWKS retrieval — to connect to an arbitrary attacker-chosen host, port, and scheme.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS