Vulnerability · Published Jun 26, 2025 · Assigned by GitHub_M
CVE-2025-52477Octo-STS Vulnerable to Unauthenticated SSRF with HTTP Response Reflection in OIDC Flow
High 8.6
In plain English
A high-severity server-side request forgery in app from octo-sts. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Octo-STS is a GitHub App that acts like a Security Token Service (STS) for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error logs with sensitive information. Upgrade to v0.5.3 to resolve this issue. This version includes patch sets to sanitize input and redact logging.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/octo-sts/app | 0.5.3 | GHSA-h3qp-hwvr-9xcq |
| Go | github.com/octo-sts/app | 0.5.3 | GO-2025-3779 |
Affected products (as reported)
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N