Octopus Server versions prior to a specified fix perform OIDC token issuer validation inconsistently. This flaw allows tokens from improperly configured non-legitimate issuers to be accepted as valid service account tokens from trusted issuers. Exploitation requires a service account with an OIDC identity configured and knowledge or guessing of identity details. The vulnerability has a high severity rating with a CVSS score of 8.7.