Eclipse CSI - PIA's OIDC issuer allowlist uses a bare string prefix check (issuer.startswith('https://ci.eclipse.org')) instead of validating the issuer as a host-bounded URL. This allows attackers to craft issuer strings such as 'https://[email protected]' or 'https://ci.eclipse.org.evil.host' that pass the prefix check but redirect OIDC discovery and JWKS fetches to attacker-controlled servers. An unauthenticated caller of the POST /v1/upload/sbom endpoint can exploit this to make PIA perform outbound HTTP(S) requests to arbitrary hosts and have oidc.verify_token accept JWTs signed with the attacker's key. This constitutes a server-side request forgery (CWE-918) vulnerability with potential for token forgery and unauthorized access.

An unauthenticated attacker can exploit this vulnerability to make the affected system perform arbitrary outbound HTTP(S) requests to attacker-controlled servers. This can lead to unauthorized acceptance of JWT tokens signed by the attacker, potentially allowing privilege escalation or unauthorized access within the system. The vulnerability does not impact availability but has low confidentiality impact and high integrity impact as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing the POST /v1/upload/sbom endpoint to untrusted users or networks. Review and improve OIDC issuer validation logic to ensure proper host-bounded URL checks rather than simple string prefix matching.