The vulnerability in Eclipse CSI - PIA (version 0.4.0) involves the /v1/upload/sbom endpoint accepting a Bearer JWT token and checking its unverified 'iss' claim against an issuer allowlist using Python's urlparse. However, urlparse and the requests/urllib3 libraries parse authority strings containing backslashes differently. This discrepancy allows an attacker to craft an issuer string that passes the allowlist check but causes the requests library to connect to an arbitrary host, port, and scheme controlled by the attacker. This leads to server-side request forgery (CWE-918), enabling the attacker to make the server perform unintended network requests during OIDC discovery and JWKS retrieval.

An attacker can exploit this vulnerability to make the vulnerable server initiate network connections to arbitrary hosts, potentially leading to unauthorized internal network access, information disclosure, or interaction with internal services. The vulnerability does not require authentication or user interaction and has a high impact on confidentiality and integrity due to the ability to influence server-side requests.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing the vulnerable endpoint to untrusted users or networks. Monitor for unusual outbound network activity from the affected service. Do not rely solely on issuer allowlist checks that use urlparse for validation of JWT claims containing URLs with backslashes.