The vulnerability in Dapr Sentry involves the OIDC discovery endpoint deriving the issuer and jwks_uri from the request Host header, honoring an attacker-controlled X-Forwarded-Host header without validation if no allowed-hosts list is configured (which is the default). This allows a remote unauthenticated attacker to poison the /.well-known/openid-configuration document served with a one-hour public cache lifetime. As a result, relying parties performing dynamic discovery may fetch JWKS from an attacker-controlled server, leading to acceptance of attacker-signed JWTs. The vulnerability requires the OIDC server to be enabled and no jwt-issuer or oidc-allowed-hosts configured, making it a configuration-dependent issue.

An attacker can remotely manipulate the OIDC discovery document to redirect JWKS fetching to a malicious server, enabling acceptance of attacker-signed JWTs by relying parties. This compromises authentication integrity and can lead to unauthorized access. The vulnerability is exploitable without authentication but requires specific insecure configuration (no jwt-issuer or allowed hosts).

No official patch or fix is currently confirmed. Mitigation involves configuring the OIDC server with a jwt-issuer or an allowed-hosts list to prevent trusting attacker-controlled X-Forwarded-Host headers. Until a patch is available, administrators should ensure these configurations are set to avoid exploitation.