Eclipse Foundation Csi - Pia vulnerabilities
- eclipse foundation csi - piajwks_uri from the OIDC discovery document is fetched without checking its origin or scheme5.1 Medium
- eclipse foundation csi - piaPre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop6.9 Medium
- eclipse foundation csi - piaUnauthenticated SSRF in PIA via OIDC issuer allowlist bypass8.8 High
- eclipse foundation csi - piaPIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.org ') in is_issuer_known, pia/models.py:139) instead of validating the issuer as…8.2 High
- eclipse foundation csi - piaThe /v1/upload/sbom endpoint extracts the iss claim from the attacker-supplied JWT with signature verification disabled, then interpolates that string into three log statements before any validation g…6.9 Medium